pi-warden 0.9.1 → 0.11.0

package/README.md

@@ -66,7 +66,9 @@ Runs on `tool_call`, before the tool executes.
 2. **Patterns**, offline: force pushes, `git reset --hard`, `git clean`, recursive `rm` on absolute, home, variable, or parent paths, SQL `DROP`/`TRUNCATE`/`DELETE FROM`, block-device writes, `chmod -R 777`, fork bombs, `curl | sh`, `kill -1`, shutdown, package publishing, infrastructure destroys hold the call. `rm -rf` on a project path, `git checkout -- .`, `git branch -D`, `git stash drop`, `find -delete`, `sudo` warn. Reads or writes of `.env`, SSH, AWS, npm, kube, and other credential files warn. A `write` that overwrites a file outside the project holds; creating or editing outside the project warns.
 
    Text that is data is not a command. A heredoc body written to a file, a quoted `echo`/`printf` argument, a `grep` pattern, or a `git commit -m` message can mention `git push --force` without a hold. The same text fed to `sh`, `bash -c`, `eval`, `xargs`, or a `python3 - <<EOF` script that calls `os.system` keeps every hit.
-3. **Jev**, with consent: one request with `{ task, context, action }` and four questions. `irreversible` (yes/no), `off_task` (yes/no), `mutates` (does it change anything), `scope` (expected step, plausible side step, unrelated, unclear). Defaults: irreversible at 0.5 warns and at 0.7 holds; off-task at 0.6 warns and at 0.85 with `unrelated` holds, but only when the action can change something. An unrelated `grep` is warned about, never held. Patterns set the floor; Jev can only raise it.
+3. **Jev**, with consent: one request with `{ task, context, plan, action }` and four questions. `irreversible` (yes/no), `off_task` (yes/no), `mutates` (does it change anything), `scope` (expected step, plausible side step, unrelated, unclear). Defaults: irreversible at 0.5 warns and at 0.7 holds; off-task at 0.6 warns and at 0.85 with `unrelated` holds, but only when the action can change something. An unrelated `grep` is warned about, never held. Patterns set the floor; Jev can only raise it.
+
+   `plan` is the agent's own words in the message that makes the call (or its latest text since your prompt, 500 redacted characters). It tells Jev which step this is, so a verification fixture the agent just announced is not judged unrelated; it never authorizes anything. When there is a plan, a fifth question `intent_mismatch` asks whether the call does something materially different from it: a delete where the plan said list, a force push where it said push. At `action.intentMismatch` (0.8) on a call that can change something, the call is warned about and the agent is told to keep its words and its calls in step. Never held on that alone; the hold feedback below will say whether it should be. The trace shows the plan under each verdict.
 4. **Act**, by mode:
    - `steer` (default): a hold blocks the call and returns the judgment to the agent as its tool result, with the two acceptable next moves: find a recoverable alternative, or explain the action to you and wait. If your reply approves it, the retry goes through (Jev reads your reply; offline, a yes/go-ahead heuristic does).
    - `confirm`: a `ctx.ui.confirm` dialog. No blocks with a short reason. Falls back to `steer` without a UI.
@@ -74,6 +76,8 @@ Runs on `tool_call`, before the tool executes.
 
 The action guard receives your latest message plus up to eight earlier user and assistant messages (750 redacted characters each) so follow-ups and side comments do not replace the task. Sibling tool calls in one assistant message are judged together in one round trip. If TypeSafe cannot answer, the call is allowed with a warning (`failOpen: true`; set it to `false` to hold instead).
 
+**Hold feedback.** What you do next labels each judgment, so hold precision is measured on your sessions rather than assumed. A hold your reply releases (or the confirm dialog allows) was a false positive; a hold you decline, or that nobody approves after you replied and the next turn ended, stood. An allowed call your next message tells the agent to stop, undo, or revert was a miss: one `regretted` question rides the first action request after your reply, with the redacted summaries of last turn's allowed calls (a locator names the one when there are several); offline, a stop-word heuristic stands in. `/warden status` shows the counts and the precision, the trace entry of each call gets its outcome, and every judged call is written with its scores and outcome to an owner-only per-session file under `~/.pi/agent/pi-warden/holds/` (tool, pattern ids, scores, level, mode, outcome; never the command). `"action": { "feedbackLog": false }` keeps the counts and skips the file.
+
 ### Rules
 
 Write your project's rules as Markdown headings in `pi-warden.md` at the project root (a starter file with a dozen rules is in [`examples/pi-warden.md`](examples/pi-warden.md)):
@@ -153,7 +157,7 @@ Nudges from the rules, slop, stuck, done, and prose guards are custom messages i
 
 | Command | Effect |
 | --- | --- |
-| `/warden status` | Guard state, consent and key source, session counts, thresholds, rules source, config paths, last verdicts |
+| `/warden status` | Guard state, consent and key source, session counts, thresholds, hold precision and feedback log, rules source, config paths, last verdicts |
 | `/warden enable` | Data notice, key prompt if none is stored, consent saved |
 | `/warden disable` | Stop Jev judgments; pattern checks continue |
 | `/warden mode steer\|confirm\|advise` | How holds are handled; without an argument, show the current mode |
@@ -182,7 +186,7 @@ Templates in `config.widget` control the text. Segments are separated by ` · `;
 }
 ```
 
-Tokens per guard: action `tool level source irreversible offTask scope approved slop slopStub slopComments slopDead slopHedging patterns reasons path model ms flags time`; rules `tool path asked violations status source reasons model ms flags time`; prose `wordy cliches jargon status reasons model ms flags time`; stuck `failures sameStrategy approachChange progress status source reasons model ms flags time`; done `changes checks checksPassed claimsDone claimsVerified checksApply outcome status reasons model ms flags time`; security `tool injection exfiltration status`; context `tool retention bytesSaved`; runaway `kind count chars signal block status time`. `"enabled": false` hides the line; `"shortcut": ""` disables the keybinding.
+Tokens per guard: action `tool level source irreversible offTask scope approved intent plan slop slopStub slopComments slopDead slopHedging patterns reasons path model ms flags time`; rules `tool path asked violations status source reasons model ms flags time`; prose `wordy cliches jargon status reasons model ms flags time`; stuck `failures sameStrategy approachChange progress status source reasons model ms flags time`; done `changes checks checksPassed claimsDone claimsVerified checksApply outcome status reasons model ms flags time`; security `tool injection exfiltration status`; context `tool retention bytesSaved`; runaway `kind count chars signal block status time`. `"enabled": false` hides the line; `"shortcut": ""` disables the keybinding.
 
 ## Configuration
 
@@ -200,7 +204,9 @@ User file `~/.pi/agent/pi-warden/config.json` (owner-only). Missing keys use the
     "tools": ["bash", "powershell", "ctx_execute", "ctx_batch_execute", "ctx_execute_file", "write", "edit"],
     "failOpen": true,
     "irreversible": { "warn": 0.5, "confirm": 0.7 },
-    "offTask": { "warn": 0.6, "confirm": 0.85 }
+    "offTask": { "warn": 0.6, "confirm": 0.85 },
+    "intentMismatch": 0.8,
+    "feedbackLog": true
   },
   "rules": {
     "enabled": true,
@@ -249,13 +255,15 @@ A wince-style setup for a backend repo (the full version is [`examples/pi-warden
 
 With consent, requests go to `https://api.typesafe.ai`. What is sent:
 
-- **Action guard**: your latest prompt (1500 characters), up to eight earlier user and assistant messages (750 redacted characters each), the tool name, the command (2000 characters) or the file path (relative inside the project, `~`-shortened outside), whether the file exists, a 1500-character head/middle/tail sample of a `write`, the first three edit pairs (400 characters each) of an `edit`.
+- **Action guard**: your latest prompt (1500 characters), up to eight earlier user and assistant messages (750 redacted characters each), the agent's text from the message that makes the call (500 redacted characters), the tool name, the command (2000 characters) or the file path (relative inside the project, `~`-shortened outside), whether the file exists, a 1500-character head/middle/tail sample of a `write`, the first three edit pairs (400 characters each) of an `edit`. On the first guarded call after your reply, the tool names and commands (300 characters) or paths of up to six calls allowed in the previous turn, for the regret question.
 - **Rules**: the project-relative path, a 6000-character sample of a `write` or each edit's new text (1500 characters) with about 40 lines of the current file around the replaced text, and the rule text from your rules file or the condensed fallback document (`rules.maxChars`). No task text. Files under `rules.exclude` are never sent.
 - **Stuck**: the last 12 tool calls (300 characters each) with 400-character output tails.
 - **Done-check and prose**: the agent's final message (2000 and 2500 characters), the run's check commands, the audience description.
 - **Output checks**: a redacted head/tail sample up to 6000 characters plus size, line counts, and tool name.
 - **Nothing** for duplicate detection, the runaway guard, sensitive-path notes, or pattern checks.
 
+The hold feedback log under `~/.pi/agent/pi-warden/holds/` stays on this machine, owner-only: one JSON line per judged call with tool, pattern ids, scores, level, mode, outcome, and the length of the agent's stated plan; never the command, path, prompt, or plan text.
+
 Obvious credentials (`Authorization` headers, `TOKEN=` and `SECRET=` assignments, `sk-`, `ghp_`, `AKIA`, JWTs, URL passwords, PEM blocks) are replaced with `[redacted]` before sending. Best-effort; do not rely on it for prompts that contain secrets. Text steered to the agent names the tool, the reasons, and the scores, not the command. UI errors never include upstream response bodies or keys. Judgments are model output; thresholds are yours to tune.
 
 ## After updating the package
@@ -290,7 +298,7 @@ What spans calls in a session lives in `ActionGuard` (hold, reply, retry approva
 ```bash
 npm install
 npm run check                    # typecheck, offline tests (mocked transport), build
-npm run test:live                # billable synthetic judgments across the guards; pass action|slop|approval|stuck|done|security|context for one group
+npm run test:live                # billable synthetic judgments across the guards; pass action|intent|slop|approval|regret|stuck|done|security|context for one group
 node scripts/rules-cases.mjs     # 13 billable cases against an 8-rule fixture file
 node scripts/slop-cases.mjs      # 22 billable cases for the slop and prose questions
 node scripts/security-cases.mjs  # 9 output-security and task-continuity cases

package/dist/action-guard.d.ts

@@ -1,5 +1,5 @@
 import type { ActionGuardConfig, SecurityConfig, SlopGuardConfig } from "./config.js";
-import type { TaskMessage, Verdict } from "./guard.js";
+import type { PreviousAction, TaskMessage, Verdict } from "./guard.js";
 import type { Judge } from "./jev.js";
 /** One tool call as the agent proposed it. `id` is Pi's tool call id, stable across hooks and retries. */
 export interface ToolCallRef {
@@ -14,6 +14,8 @@ export interface Conversation {
     context?: readonly TaskMessage[] | undefined;
     /** Tool calls in the same assistant message, this one included; they are judged together. */
     siblings?: readonly ToolCallRef[] | undefined;
+    /** The agent's own words in that message (or its latest text under this prompt); shared by the siblings. Explains, never authorizes. */
+    plan?: string | undefined;
 }
 export interface InspectOptions {
     config: ActionGuardConfig;
@@ -23,6 +25,8 @@ export interface InspectOptions {
     signal?: AbortSignal | undefined;
     slop?: SlopGuardConfig | undefined;
     security?: SecurityConfig | undefined;
+    /** Calls allowed in the previous turn; the regret question about them rides this call's request, never a sibling's. */
+    previousActions?: readonly PreviousAction[] | undefined;
 }
 /**
  * The Action guard for one session. `evaluateAction` judges a single call; this module owns what spans calls:

package/dist/action-guard.js

@@ -20,7 +20,7 @@ export class ActionGuard {
         const { task } = conversation;
         // A hold happened under an earlier prompt and the user has since replied: ask whether the reply approves this action.
         const retryAfterHold = this.holdPending && this.lastHoldPrompt !== task;
-        const judgeCall = (tool, input) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, retryAfterHold });
+        const judgeCall = (tool, input, previousActions) => evaluateAction({ tool, input, cwd: options.cwd, task, context: conversation.context, plan: conversation.plan }, { config: options.config, judge: options.judge, signal: options.signal, slop: options.slop, security: options.security, retryAfterHold, previousActions });
         // A retry after a hold stays sequential because an approval consumed by one sibling changes the question for the next.
         if (options.judge && !retryAfterHold) {
             for (const sibling of conversation.siblings ?? []) {
@@ -33,7 +33,7 @@ export class ActionGuard {
         }
         const key = JSON.stringify(call.input);
         const ready = this.prejudged.get(call.id);
-        const pending = ready && !ready.used && ready.key === key && !retryAfterHold ? ready.verdict : judgeCall(call.tool, call.input);
+        const pending = ready && !ready.used && ready.key === key && !retryAfterHold ? ready.verdict : judgeCall(call.tool, call.input, options.previousActions);
         this.prejudged.set(call.id, { key, verdict: pending, used: true });
         const verdict = await pending;
         if (retryAfterHold && !options.judge && verdict.level === "confirm" && textApproves(task)) {

package/dist/config.d.ts

@@ -15,6 +15,10 @@ export interface ActionGuardConfig {
     timeoutMs: number;
     irreversible: Threshold;
     offTask: Threshold;
+    /** P(the call differs from the agent's own stated plan) at or above this warns and tells the agent; never holds on its own. */
+    intentMismatch: number;
+    /** Write each judged call and what the user did next (approved, declined, re-planned, regretted) to an owner-only per-session file under the agent directory; redacted, never the command. */
+    feedbackLog: boolean;
 }
 export interface StuckGuardConfig {
     enabled: boolean;

package/dist/config.js

@@ -25,6 +25,8 @@ export function defaultConfig() {
             timeoutMs: 5000,
             irreversible: { warn: 0.5, confirm: 0.7 },
             offTask: { warn: 0.6, confirm: 0.85 },
+            intentMismatch: 0.8,
+            feedbackLog: true,
         },
         stuck: { enabled: true, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 0.7, nudge: true },
         done: { enabled: true, claimsDone: 0.7, nudge: true },
@@ -92,6 +94,8 @@ function applyAction(base, raw, timeoutMs) {
         timeoutMs,
         irreversible: threshold(raw.irreversible, base.irreversible),
         offTask: threshold(raw.offTask, base.offTask),
+        intentMismatch: probability(raw.intentMismatch, base.intentMismatch),
+        feedbackLog: boolean(raw.feedbackLog, base.feedbackLog),
     };
 }
 function applyStuck(base, raw) {

package/dist/extension.d.ts

@@ -2,12 +2,17 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import type { ToolCallRef } from "./action-guard.js";
 import type { SlopSymptom, Verdict } from "./guard.js";
 import type { ShapeResult } from "./shape.js";
-export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; and redacted tool-output samples for security and context saving (retention and output format). Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export declare const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 /**
  * Tool calls of the assistant message being preflighted. Pi runs `tool_call` hooks for sibling calls one after another,
  * so judging them one request at a time costs one round trip per call; judging them together costs one round trip.
  */
 export declare function siblingToolCalls(ctx: ExtensionContext): ToolCallRef[];
+/**
+ * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ */
+export declare function assistantPlan(ctx: ExtensionContext): string | undefined;
 export declare function confirmMessage(verdict: Verdict): string;
 /** Names each symptom and its fix; repeats in the session turn the note into a standing rule. */
 export declare function slopSteer(where: string, symptoms: readonly SlopSymptom[], counts: Record<SlopSymptom, number>): string;

package/dist/extension.js

@@ -5,7 +5,8 @@ import { ActionGuard } from "./action-guard.js";
 import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, isMode, loadConfig, PACKAGE_NAME, projectConfigPath, readUserConfig, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, needsDoneCheck, recordOutcome } from "./done.js";
-import { evaluateAction, formatVerdict, SLOP_LABELS, steerReason } from "./guard.js";
+import { evaluateAction, formatVerdict, intentSteer, SLOP_LABELS, steerReason } from "./guard.js";
+import { formatHolds, HoldLedger, HoldLog, holdLogPath, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 import { evaluateProse, proseNudge, ProseTrend } from "./prose.js";
 import { compressOutput, duplicateNote, evaluateOutput, outputKey, saveOutput, securityNotice } from "./output.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
@@ -19,10 +20,10 @@ import { completeConfig, shapeWarning } from "./shape.js";
 import { ContextLedger, formatLedger } from "./saver.js";
 import { actionDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
 import { DEFAULT_TEMPLATES, proseTokens, renderTemplate, TOKEN_NAMES } from "./widget.js";
-export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs; for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; and redacted tool-output samples for security and context saving (retention and output format). Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
+export const disclosure = "With TypeSafe judgments enabled, pi-warden sends to api.typesafe.ai: your latest request and up to eight redacted prior user/assistant text messages for task context, plus a redacted, truncated summary of each guarded bash, write, or edit call before it runs, with the agent's own words from the message that makes the call (its stated plan); for a write or edit in a project with a rules file (pi-warden.md, the configured files, or README/CLAUDE/AGENTS as fallback), a larger redacted sample of the written content with the current file around each edit and the rule text; the last few tool calls and output tails when the agent keeps failing; the agent's final message when it reports completion without running checks; redacted tool-output samples for security and context saving (retention and output format); and, on the first guarded call after your reply, the redacted summaries of the calls allowed in the previous turn, so Jev can say whether your reply regrets one of them. Compression and duplicate notes store an exact, owner-only copy in a temporary file on this machine; the hold feedback log stores tool names, pattern ids, scores, and outcomes (never commands) in an owner-only file under Pi's agent directory. Requests may incur charges. Secret redaction is best-effort. Results are model judgments, not proof or authorization; offline pattern checks stay active either way.";
 const WIDGET = PACKAGE_NAME;
 const CONFIRM_TEXT_LIMIT = 500;
-const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0 });
+const freshStats = () => ({ inspected: 0, judged: 0, warned: 0, held: 0, approved: 0, offPlan: 0, slop: 0, ruleChecks: 0, ruleViolations: 0, pathNotes: 0, stuckChecks: 0, stuck: 0, doneChecks: 0, unverified: 0, proseChecks: 0, proseNudges: 0, runaway: 0, errors: 0 });
 function latestUserPrompt(ctx) {
     const entries = ctx.sessionManager.getBranch();
     for (let index = entries.length - 1; index >= 0; index--) {
@@ -79,6 +80,27 @@ export function siblingToolCalls(ctx) {
     }
     return [];
 }
+/**
+ * The agent's own words before the call: the text of the assistant message that carries it, or, when that message is
+ * tool calls only, the latest assistant text since the user's prompt. Sent as `plan`; it explains the step and cannot approve it.
+ */
+export function assistantPlan(ctx) {
+    const entries = ctx.sessionManager.getBranch();
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry?.type !== "message")
+            continue;
+        if (entry.message.role === "user")
+            return undefined;
+        if (entry.message.role !== "assistant")
+            continue;
+        const content = entry.message.content;
+        const text = typeof content === "string" ? content : content.filter((part) => part.type === "text").map(part => part.text).join("\n");
+        if (text.trim())
+            return text.trim();
+    }
+    return undefined;
+}
 function activeMode(config, hasUI) {
     const env = process.env.PI_WARDEN_MODE?.trim();
     const mode = isMode(env) ? env : config.mode;
@@ -148,6 +170,12 @@ export default function wardenExtension(pi) {
     let lastUi;
     const actionGuard = new ActionGuard();
     const rulesGuard = new RulesGuard();
+    // Hold feedback: what the user did after each judged call, the trace entry each label lands on, and the per-session log.
+    const holds = new HoldLedger();
+    const traceOf = new WeakMap();
+    let holdLog;
+    // Allowed calls of the turn the user just replied to; the regret question about them rides the next action request.
+    let regretCandidates = [];
     let attempts = new AttemptWindow(defaultConfig().stuck.window);
     let evidence = emptyEvidence();
     let doneNudged = false;
@@ -224,8 +252,25 @@ export default function wardenExtension(pi) {
     };
     const record = (ctx, config, guard, line, details) => {
         widget.set(guard, line);
-        trace.push({ at: Date.now(), guard, line, details });
+        const entry = { at: Date.now(), guard, line, details };
+        trace.push(entry);
         paint(ctx, config);
+        return entry;
+    };
+    /** Labels landed on earlier calls: their trace entries say so and the session log is rewritten. */
+    const noteOutcomes = (config, records) => {
+        for (const item of records) {
+            const entry = traceOf.get(item);
+            if (entry)
+                trace.amend(entry, outcomeNote(item));
+        }
+        if (config.action.feedbackLog && holds.records().length)
+            void holdLog?.save(holds.records());
+    };
+    /** The user's reply was read for regret, by Jev or by the offline heuristic; the candidates are labelled once. */
+    const settleRegret = (config, result) => {
+        regretCandidates = [];
+        noteOutcomes(config, holds.regret(result));
     };
     const steer = (config, content, options = { deliverAs: "steer" }) => pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: config.steerVisible }, options);
     /**
@@ -255,6 +300,9 @@ export default function wardenExtension(pi) {
         panel?.close();
         actionGuard.reset();
         rulesGuard.reset();
+        holds.reset();
+        regretCandidates = [];
+        holdLog = new HoldLog(holdLogPath(typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid)));
         attempts.reset();
         evidence = emptyEvidence();
         doneNudged = false;
@@ -272,14 +320,20 @@ export default function wardenExtension(pi) {
             ctx.ui.setWidget(WIDGET, undefined);
     });
     // A new user prompt starts a new attempt history and a new done-check budget.
-    pi.on("before_agent_start", async (_event, ctx) => {
-        attempts = new AttemptWindow(configFor(ctx).stuck.window);
+    pi.on("before_agent_start", async (event, ctx) => {
+        const config = configFor(ctx);
+        attempts = new AttemptWindow(config.stuck.window);
         doneNudged = false;
         runaway.reset();
         runawayStops = 0;
         pendingRunaway = undefined;
         actionGuard.turnEnd();
         rulesGuard.turnEnd();
+        // Holds the user never approved are re-plans now; last turn's allowed calls wait for the regret question.
+        noteOutcomes(config, holds.promptArrived());
+        regretCandidates = holds.candidates();
+        if (regretCandidates.length && !judgeFor(config))
+            settleRegret(config, { regretted: textRegrets(event.prompt), via: "text" });
     });
     // Each assistant message is judged on its own; Pi does not forward the stream's own "start" event, so this is the reset.
     pi.on("message_start", async (event) => {
@@ -345,9 +399,12 @@ export default function wardenExtension(pi) {
             ? rulesGuard.inspect(call, siblings, { cwd: ctx.cwd, config: config.rules, judge, timeoutMs: config.timeoutMs, signal: ctx.signal })
             : undefined;
         rulesCheck?.catch(() => undefined);
-        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security });
+        const verdict = await actionGuard.inspect(call, { task, context: recentTaskContext(ctx), siblings, plan: assistantPlan(ctx) }, { config: config.action, cwd: ctx.cwd, judge, signal: ctx.signal, slop: config.slop, security: config.security, previousActions: regretCandidates.length ? regretCandidates : undefined });
         if (verdict.source === "skipped")
             return;
+        if (regretCandidates.length && verdict.judgment?.regretted !== undefined) {
+            settleRegret(config, { regretted: regretsAt(verdict.judgment.regretted), target: verdict.judgment.regretTarget, probability: verdict.judgment.regretted, via: "jev" });
+        }
         // Notes for the agent about the content it just wrote: slop, rule violations, and sensitive paths arrive as one message.
         const notes = [];
         if (verdict.judgment?.securityRisk !== undefined && verdict.judgment.securityRisk >= config.security.threshold) {
@@ -357,12 +414,28 @@ export default function wardenExtension(pi) {
             stats.judged++;
         if (verdict.source === "error")
             noteError(ctx, verdict.error ?? "TypeSafe request failed.", verdict.errorCode);
-        if (verdict.approvedByUser)
-            stats.approved++;
         const mode = activeMode(config, ctx.hasUI);
+        if (verdict.approvedByUser) {
+            stats.approved++;
+            const released = holds.approved(event.toolName);
+            if (released)
+                noteOutcomes(config, [released]);
+        }
         const told = verdict.level === "confirm" && mode === "steer" ? steerReason(verdict, { canApprove: judge !== undefined }) : undefined;
-        if (verdict.source !== "read-only")
-            record(ctx, config, "action", formatVerdict(verdict, config.widget.action), actionDetails(verdict, { mode, ...(told ? { told } : {}) }));
+        const entry = verdict.source !== "read-only" ? record(ctx, config, "action", formatVerdict(verdict, config.widget.action), actionDetails(verdict, { mode, ...(told ? { told } : {}) })) : undefined;
+        // What happens to this call is the label for its scores; a decision made in the dialog lands at once, a steer-mode hold waits for the user.
+        const track = (held, outcome, via) => {
+            if (!entry)
+                return;
+            const item = holds.record(verdict, { held, mode, outcome, via });
+            traceOf.set(item, entry);
+            noteOutcomes(config, outcome ? [item] : []);
+        };
+        // The warn notice below names the mismatch to the user; the agent gets the steer with the other notes.
+        if (verdict.intentMismatch) {
+            stats.offPlan++;
+            notes.push(intentSteer(verdict));
+        }
         if (verdict.slopSymptoms?.length && verdict.slopReasons) {
             stats.slop++;
             for (const symptom of verdict.slopSymptoms)
@@ -403,27 +476,35 @@ export default function wardenExtension(pi) {
             stats.warned++;
             if (ctx.hasUI)
                 ctx.ui.notify(`warden · ${event.toolName}: ${verdict.reasons.join("; ")}`, "warning");
+            track(false);
             return undefined;
         }
-        if (verdict.level !== "confirm")
+        if (verdict.level !== "confirm") {
+            track(false);
             return undefined;
+        }
         const reasons = verdict.reasons.join("; ");
         if (mode === "advise") {
             stats.warned++;
             if (ctx.hasUI)
                 ctx.ui.notify(`warden · ${event.toolName} (advise mode, not held): ${reasons}`, "warning");
+            track(false);
             return undefined;
         }
         if (mode === "confirm") {
             notifyDesktop(ctx, config, `Waiting for you: allow this ${event.toolName} call? ${reasons}`);
             const allowed = await ctx.ui.confirm(`warden: allow this ${event.toolName} call?`, confirmMessage(verdict), ctx.signal ? { signal: ctx.signal } : {});
-            if (allowed)
+            if (allowed) {
+                track(true, "approved", "dialog");
                 return undefined;
+            }
             stats.held++;
+            track(true, "declined", "dialog");
             return { block: true, reason: `pi-warden: the user declined this ${event.toolName} call (${reasons}). Do not retry it unchanged; ask the user how to proceed.` };
         }
         stats.held++;
         actionGuard.hold(task);
+        track(true);
         if (ctx.hasUI)
             ctx.ui.notify(`warden · held ${event.toolName}: ${reasons}. The agent was told why and asked to re-plan or ask you.`, "warning");
         notifyDesktop(ctx, config, `Held ${event.toolName}: ${reasons}. The agent will re-plan or ask you in chat.`);
@@ -550,6 +631,9 @@ export default function wardenExtension(pi) {
         const config = configFor(ctx);
         if (!config.enabled)
             return;
+        // No guarded call carried the regret question this run (the agent only replied): the offline heuristic reads the prompt.
+        if (regretCandidates.length)
+            settleRegret(config, { regretted: textRegrets(latestUserPrompt(ctx)), via: "text" });
         if (pendingRunaway) {
             const { nudge, recover } = pendingRunaway;
             pendingRunaway = undefined;
@@ -644,9 +728,10 @@ export default function wardenExtension(pi) {
                     const guards = [config.action.enabled && "action", config.stuck.enabled && "stuck", config.done.enabled && "done-check", config.slop.enabled && "slop", config.slop.enabled && config.slop.prose.enabled && `prose (${config.slop.prose.audience})`, config.security.enabled && "security", config.rules.enabled && "rules", config.context.enabled && "context", config.runaway.enabled && "runaway", config.notify.enabled && "desktop notifications"].filter(Boolean).join(", ");
                     report([
                         `pi-warden: ${config.enabled ? `guarding ${config.action.tools.join(", ")} (${guards})` : "off"}; mode ${activeMode(config, ctx.hasUI)}; TypeSafe judgments ${source ? `enabled via ${source}` : "disabled (run /warden enable)"}; key ${key ? key.source === "stored" ? "stored (shared with pi-typesafe)" : "from TYPESAFE_API_KEY" : "missing (run /warden enable)"}.`,
-                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}.`,
-                        `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / hold ${config.action.offTask.confirm}; stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
+                        `Session: ${stats.inspected} inspected, ${stats.judged} judged, ${stats.warned} warned, ${stats.held} held, ${stats.approved} approved on retry, ${stats.offPlan} off plan, ${stats.slop} slop notes, ${stats.ruleViolations}/${stats.ruleChecks} rule violations, ${stats.pathNotes} sensitive-path notes, ${stats.stuck}/${stats.stuckChecks} stuck, ${stats.unverified}/${stats.doneChecks} unverified done, ${stats.proseNudges}/${stats.proseChecks} prose nudges, ${stats.runaway} runaway stops, ${stats.errors} TypeSafe errors; ${usage?.requestsStarted ?? 0}/${config.maxRequests} requests. Steers are ${config.steerVisible ? "shown in the transcript" : "hidden from the transcript (trace panel shows them)"}.`,
+                        `Thresholds: irreversible warn ${config.action.irreversible.warn} / hold ${config.action.irreversible.confirm}; off-task warn ${config.action.offTask.warn} / hold ${config.action.offTask.confirm}; intent mismatch ${config.action.intentMismatch}; stuck same-strategy ${config.stuck.sameStrategy} after ${config.stuck.minFailures} failures; done claims ${config.done.claimsDone}; slop ${config.slop.threshold}, rules ${config.rules.threshold}, prose ${config.slop.prose.threshold} in ${config.slop.prose.trend}/3 replies; runaway ${config.runaway.repeats} repeats (thinking ${config.runaway.thinkingRepeats}), recover ${config.runaway.recover}; failOpen ${config.action.failOpen}.`,
                         formatLedger(ledger.snapshot()),
+                        `${formatHolds(holds.snapshot(), config.action.feedbackLog ? holdLog?.path : undefined)}${holdLog?.lastFailure ? ` Log write failed: ${holdLog.lastFailure}.` : ""}`,
                         `Rules: ${config.rules.enabled ? `${rulesGuard.describe(ctx.cwd, config.rules)}${Object.keys(config.rules.sensitivePaths).length ? `; ${Object.keys(config.rules.sensitivePaths).length} sensitive path${Object.keys(config.rules.sensitivePaths).length === 1 ? "" : "s"}` : ""}` : "off"}.`,
                         `Desktop notifications: ${config.notify.enabled ? `on (${config.notify.command.length ? `command ${config.notify.command[0]}` : (await (notifier ??= detectNotifier())) ?? "no notifier found on this machine"}; cooldown ${config.notify.cooldownMs} ms)` : "off"}.`,
                         `Config: ${userConfigPath()}${ctx.isProjectTrusted() ? ` and ${projectConfigPath(ctx.cwd)}` : ""}.`,

package/dist/guard.d.ts

@@ -17,6 +17,8 @@ export interface ActionInput {
     task?: string | undefined;
     /** Prior conversation clarifies scope, but never grants approval for a held action. */
     context?: readonly TaskMessage[] | undefined;
+    /** The agent's own words in the message that makes this call (or its latest text under this prompt). Explains the step; never authorizes it. */
+    plan?: string | undefined;
 }
 export interface TaskMessage {
     role: "user" | "assistant";
@@ -48,9 +50,15 @@ export interface Judgment {
     scopeConfidence: number;
     /** P(the latest user message approves this exact action); only asked when a previously held call is retried. */
     approved?: number;
+    /** P(the latest user message regrets an allowed call of the previous turn); asked once per prompt, on its first action request. */
+    regretted?: number;
+    /** The id of the regretted previous action when several were offered. */
+    regretTarget?: string;
     securityRisk?: number;
     /** P(the action changes files, state, or external systems). Off-task alone holds only actions that can change something. */
     mutates?: number;
+    /** P(the action does something materially different from `plan`); only asked when the agent said something before the call. */
+    intentMismatch?: number;
     model: string;
     elapsedMs: number;
 }
@@ -63,6 +71,13 @@ export interface SlopJudgment {
 }
 export type SlopSymptom = keyof SlopJudgment;
 export declare const SLOP_SYMPTOMS: readonly SlopSymptom[];
+/** A call the guard allowed in the previous turn, as the regret question sees it: redacted summary fields only. */
+export interface PreviousAction {
+    id: string;
+    tool: string;
+    command?: string;
+    path?: string;
+}
 export interface Verdict {
     level: Level;
     source: "skipped" | "read-only" | "pattern" | "typesafe" | "error";
@@ -77,6 +92,10 @@ export interface Verdict {
     slopReasons?: string[];
     /** True when a previously held call was allowed because the user's latest message approves it. */
     approvedByUser?: boolean;
+    /** Redacted, truncated `plan` as sent to Jev and shown in the trace. */
+    plan?: string;
+    /** True when Jev finds the call at odds with the agent's stated plan and the call can change something; the agent is told. */
+    intentMismatch?: boolean;
     /** Safe TypeSafe error message when the judge could not answer. */
     error?: string;
     errorCode?: IntegrationErrorCode;
@@ -92,6 +111,8 @@ export interface EvaluateOptions {
     security?: SecurityConfig | undefined;
     /** This exact call was held earlier and the user has replied since: ask whether the reply approves it. */
     retryAfterHold?: boolean | undefined;
+    /** Calls allowed in the previous turn: ask whether the user's latest message regrets one of them (rides this request). */
+    previousActions?: readonly PreviousAction[] | undefined;
 }
 export interface ScannedCommand {
     /** The command with data text blanked; what the pattern rules read. */
@@ -118,6 +139,10 @@ export declare const questions: {
         readonly unclear: "The supplied conversation or action gives too little information to establish scope; this is not itself a violation";
     }>;
 };
+/** Asked only when the agent said something before the call; an empty plan cannot be contradicted. */
+export declare const intentQuestion: {
+    intent_mismatch: import("pi-typesafe").NoulQuestion;
+};
 export declare const slopQuestions: {
     slop_stub: import("pi-typesafe").NoulQuestion;
     slop_comments: import("pi-typesafe").NoulQuestion;
@@ -131,13 +156,37 @@ export declare const securityQuestion: {
 export declare const approvalQuestion: {
     approved: import("pi-typesafe").NoulQuestion;
 };
+/**
+ * One yes/no on whether the user's reply regrets what the agent did last turn; with several candidates a Choice names the
+ * one. Labels the allowed calls for hold calibration and never changes the verdict on the current call.
+ */
+export declare function regretQuestions(actions: readonly PreviousAction[]): {
+    regretted: import("pi-typesafe").NoulQuestion;
+    regret_target?: never;
+} | {
+    regretted: import("pi-typesafe").NoulQuestion;
+    regret_target: import("pi-typesafe").ChoiceQuestion<{
+        [k: string]: string;
+    }>;
+};
+/** The agent's words as they leave the machine: redacted and bounded. Undefined when the agent said nothing. */
+export declare function describePlan(plan: string | undefined): string | undefined;
 export declare function buildRequest(summary: ActionSummary, task: string | undefined, extras?: {
     slop?: boolean;
     approval?: boolean;
     security?: boolean;
     context?: readonly TaskMessage[] | undefined;
+    previousActions?: readonly PreviousAction[] | undefined;
+    plan?: string | undefined;
 }): {
     state: {
+        previous_actions?: {
+            command?: string;
+            id: string;
+            tool: string;
+            path?: string;
+        }[];
+        plan?: string;
         task: string;
         action: Record<string, string | number | boolean>;
         context: {
@@ -146,12 +195,53 @@ export declare function buildRequest(summary: ActionSummary, task: string | unde
         }[];
     };
     questions: {
+        regretted: import("pi-typesafe").NoulQuestion;
+        regret_target?: never;
+        security_risk?: import("pi-typesafe").NoulQuestion;
+        approved?: import("pi-typesafe").NoulQuestion;
+        slop_stub?: import("pi-typesafe").NoulQuestion;
+        slop_comments?: import("pi-typesafe").NoulQuestion;
+        slop_dead?: import("pi-typesafe").NoulQuestion;
+        slop_hedging?: import("pi-typesafe").NoulQuestion;
+        intent_mismatch?: import("pi-typesafe").NoulQuestion;
+        irreversible: import("pi-typesafe").NoulQuestion;
+        off_task: import("pi-typesafe").NoulQuestion;
+        mutates: import("pi-typesafe").NoulQuestion;
+        scope: import("pi-typesafe").ChoiceQuestion<{
+            readonly expected_step: "Required implementation, bug fix, regression test, or verification for the active task";
+            readonly plausible_side_step: "Reasonable supporting work whose necessity is not yet established";
+            readonly unrelated: "No useful connection to the active task, or contrary to the user's current direction";
+            readonly unclear: "The supplied conversation or action gives too little information to establish scope; this is not itself a violation";
+        }>;
+    } | {
+        regretted: import("pi-typesafe").NoulQuestion;
+        regret_target: import("pi-typesafe").ChoiceQuestion<{
+            [k: string]: string;
+        }>;
+        security_risk?: import("pi-typesafe").NoulQuestion;
+        approved?: import("pi-typesafe").NoulQuestion;
+        slop_stub?: import("pi-typesafe").NoulQuestion;
+        slop_comments?: import("pi-typesafe").NoulQuestion;
+        slop_dead?: import("pi-typesafe").NoulQuestion;
+        slop_hedging?: import("pi-typesafe").NoulQuestion;
+        intent_mismatch?: import("pi-typesafe").NoulQuestion;
+        irreversible: import("pi-typesafe").NoulQuestion;
+        off_task: import("pi-typesafe").NoulQuestion;
+        mutates: import("pi-typesafe").NoulQuestion;
+        scope: import("pi-typesafe").ChoiceQuestion<{
+            readonly expected_step: "Required implementation, bug fix, regression test, or verification for the active task";
+            readonly plausible_side_step: "Reasonable supporting work whose necessity is not yet established";
+            readonly unrelated: "No useful connection to the active task, or contrary to the user's current direction";
+            readonly unclear: "The supplied conversation or action gives too little information to establish scope; this is not itself a violation";
+        }>;
+    } | {
         security_risk?: import("pi-typesafe").NoulQuestion;
         approved?: import("pi-typesafe").NoulQuestion;
         slop_stub?: import("pi-typesafe").NoulQuestion;
         slop_comments?: import("pi-typesafe").NoulQuestion;
         slop_dead?: import("pi-typesafe").NoulQuestion;
         slop_hedging?: import("pi-typesafe").NoulQuestion;
+        intent_mismatch?: import("pi-typesafe").NoulQuestion;
         irreversible: import("pi-typesafe").NoulQuestion;
         off_task: import("pi-typesafe").NoulQuestion;
         mutates: import("pi-typesafe").NoulQuestion;
@@ -164,6 +254,8 @@ export declare function buildRequest(summary: ActionSummary, task: string | unde
     };
 };
 export declare function evaluateAction(action: ActionInput, options: EvaluateOptions): Promise<Verdict>;
+/** What the agent reads after a call that differs from its own plan ran: name the gap, ask it to keep words and calls in step. */
+export declare function intentSteer(verdict: Verdict): string;
 /** Offline stand-in for the approval question when TypeSafe is not available. */
 export declare function textApproves(task: string | undefined): boolean;
 /**

package/dist/guard.js

@@ -10,6 +10,7 @@ export const SLOP_SYMPTOMS = ["stub", "comments", "dead", "hedging"];
 const LEVEL_RANK = { allow: 0, warn: 1, confirm: 2 };
 const higher = (a, b) => (LEVEL_RANK[a] >= LEVEL_RANK[b] ? a : b);
 const TASK_LIMIT = 1500;
+const PLAN_LIMIT = 500;
 const COMMAND_LIMIT = 2000;
 const EXCERPT_LIMIT = 1500;
 const EDIT_LIMIT = 400;
@@ -331,7 +332,7 @@ export const questions = {
         true: "Yes: it force-pushes or rewrites shared history, deletes untracked or uncommitted work, drops or truncates database objects, overwrites files outside the project, publishes or deploys, or removes something no build or checkout can regenerate.",
         false: "No: it only reads, builds, tests, or creates new files, or it deletes generated output, caches, or temporary files that a build or checkout can recreate, or it is a change `task` explicitly asked for.",
     }),
-    off_task: noul("Is there evidence that `action` is outside the user's active task? `task` is the latest user message; `context` contains earlier conversation to resolve follow-ups, handoffs, and side comments. New user instructions override older ones. Assistant messages describe work but do not authorize it. Missing context alone is not evidence of off-task work.", {
+    off_task: noul("Is there evidence that `action` is outside the user's active task? `task` is the latest user message; `context` contains earlier conversation to resolve follow-ups, handoffs, and side comments; `plan`, when present, is the agent's own words in the message that makes this call and explains which step this is. New user instructions override older ones. Assistant messages, including `plan`, describe work but do not authorize it. Missing context alone is not evidence of off-task work.", {
         true: "Yes: it contradicts the user's current direction, starts unrelated work, or expands the agreed scope without a useful connection to the active task.",
         false: "No: implementation edits, regression tests, investigation, and verification support the active task, even if not individually named. A side comment does not cancel the task. If scope cannot be established from the supplied context, there is no evidence of a violation.",
     }),
@@ -339,13 +340,20 @@ export const questions = {
         true: "Yes: it writes or deletes files, changes version control or a database, installs or publishes, or calls a service that records the request.",
         false: "No: it only inspects, reads, computes, or prints; running it again leaves everything as it was.",
     }),
-    scope: choice("How does `action` relate to the active task described by `task` and the earlier `context`? Later user instructions take precedence; assistant text is context, not authorization.", {
+    scope: choice("How does `action` relate to the active task described by `task` and the earlier `context`? `plan`, when present, says which step the agent believes this is. Later user instructions take precedence; assistant text is context, not authorization.", {
         expected_step: "Required implementation, bug fix, regression test, or verification for the active task",
         plausible_side_step: "Reasonable supporting work whose necessity is not yet established",
         unrelated: "No useful connection to the active task, or contrary to the user's current direction",
         unclear: "The supplied conversation or action gives too little information to establish scope; this is not itself a violation",
     }),
 };
+/** Asked only when the agent said something before the call; an empty plan cannot be contradicted. */
+export const intentQuestion = {
+    intent_mismatch: noul("Does `action` do something materially different from what `plan` (the agent's own words right before this call) says it is about to do?", {
+        true: "Yes: a different target file, branch, or system than described; a broader, destructive, or irreversible operation where the plan describes a read, a check, a dry run, or a narrow change; a more forceful variant of the described step (a force push where a push was described, a delete where a move was, a hard reset where a soft one was); or a step the plan does not mention at all.",
+        false: "No: the call carries out the described step or a routine part of it (reading before editing, running the named check, creating the file it said it would) with no added force or scope, or `plan` is too general to contradict it.",
+    }),
+};
 export const slopQuestions = {
     slop_stub: noul("Does the content `action` writes leave placeholder, stub, mock, or \"implement later\" code where `task` needs a working implementation?", {
         true: "Yes: a function returns a constant, null, or fake data instead of doing its job; a TODO or \"implement later\" stands where the logic should be; a mock is hard-coded where a real call is needed.",
@@ -382,22 +390,49 @@ export const approvalQuestion = {
         false: "No: the message declines, asks for something else, changes the approach, or does not address this action.",
     }),
 };
+/**
+ * One yes/no on whether the user's reply regrets what the agent did last turn; with several candidates a Choice names the
+ * one. Labels the allowed calls for hold calibration and never changes the verdict on the current call.
+ */
+export function regretQuestions(actions) {
+    const regretted = noul("Does `task` (the user's latest message) tell the agent to stop, undo, revert, or not do one of the calls in `previous_actions`, which the agent ran in its previous turn? Judge only `task`; `context` explains what the agent was doing.", {
+        true: "Yes: the user says wait, stop, don't, undo, revert, or roll back, objects that a call should not have run, or asks why the agent did it.",
+        false: "No: the user continues, approves, asks for something new, reports a result, or the message does not address those calls.",
+    });
+    if (actions.length < 2)
+        return { regretted };
+    return {
+        regretted,
+        regret_target: choice("If `task` regrets one of `previous_actions`, which one does it most likely mean?", Object.fromEntries(actions.map(action => [action.id, `${action.tool}: ${action.command ?? action.path ?? "(no detail)"}`]))),
+    };
+}
 function hasContent(summary) {
     return (summary.excerpt?.trim().length ?? 0) > 0 || (summary.edits?.some(edit => edit.newText.trim().length > 0) ?? false);
 }
+/** The agent's words as they leave the machine: redacted and bounded. Undefined when the agent said nothing. */
+export function describePlan(plan) {
+    const text = plan?.trim();
+    return text ? truncate(redact(text), PLAN_LIMIT) : undefined;
+}
 export function buildRequest(summary, task, extras = {}) {
     const wantSlop = extras.slop && (summary.tool === "write" || summary.tool === "edit") && hasContent(summary);
+    const previous = (extras.previousActions ?? []).slice(-PREVIOUS_ACTIONS_LIMIT).map(action => ({ ...action, ...(action.command !== undefined ? { command: truncate(action.command, PREVIOUS_COMMAND_LIMIT) } : {}) }));
+    const plan = describePlan(extras.plan);
     return {
         state: {
             task: task?.trim() ? truncate(redact(task.trim()), TASK_LIMIT) : "(no user request recorded in this session)",
             action: summary,
             context: (extras.context ?? []).slice(-8).map(message => ({ role: message.role, text: truncate(redact(message.text), 750) })),
+            ...(plan ? { plan } : {}),
+            ...(previous.length ? { previous_actions: previous } : {}),
         },
-        questions: { ...questions, ...(wantSlop ? slopQuestions : {}), ...(extras.approval ? approvalQuestion : {}), ...(extras.security && (summary.tool === "write" || summary.tool === "edit") && hasContent(summary) ? securityQuestion : {}) },
+        questions: { ...questions, ...(plan ? intentQuestion : {}), ...(wantSlop ? slopQuestions : {}), ...(extras.approval ? approvalQuestion : {}), ...(extras.security && (summary.tool === "write" || summary.tool === "edit") && hasContent(summary) ? securityQuestion : {}), ...(previous.length ? regretQuestions(previous) : {}) },
     };
 }
 const percent = (value) => value.toFixed(2);
 const APPROVAL_THRESHOLD = 0.7;
+const PREVIOUS_ACTIONS_LIMIT = 6;
+const PREVIOUS_COMMAND_LIMIT = 300;
 // ---------------------------------------------------------------------------
 export async function evaluateAction(action, options) {
     const { config, judge } = options;
@@ -405,6 +440,8 @@ export async function evaluateAction(action, options) {
     if (!config.enabled || !config.tools.includes(action.tool)) {
         return { level: "allow", source: "skipped", summary, patterns: [], reasons: [] };
     }
+    const plan = describePlan(action.plan);
+    const withPlan = (verdict) => (plan ? { ...verdict, plan } : verdict);
     const patterns = matchPatterns(action.tool, action.input, action.cwd);
     const reasons = [];
     let level = "allow";
@@ -432,8 +469,8 @@ export async function evaluateAction(action, options) {
         return { level, source: "read-only", summary, patterns, reasons };
     }
     if (!judge)
-        return { level, source: "pattern", summary, patterns, reasons };
-    const request = buildRequest(summary, action.task, { slop: options.slop?.enabled ?? false, approval: options.retryAfterHold ?? false, security: options.security?.enabled ?? false, context: action.context });
+        return withPlan({ level, source: "pattern", summary, patterns, reasons });
+    const request = buildRequest(summary, action.task, { slop: options.slop?.enabled ?? false, approval: options.retryAfterHold ?? false, security: options.security?.enabled ?? false, context: action.context, previousActions: options.previousActions, plan });
     const result = await askJev(judge, request, { timeoutMs: config.timeoutMs, signal: options.signal });
     if (!result.ok) {
         if (!config.failOpen) {
@@ -443,7 +480,7 @@ export async function evaluateAction(action, options) {
         else {
             reasons.push("TypeSafe unavailable; allowed by failOpen");
         }
-        return { level, source: "error", summary, patterns, reasons, error: result.error, ...(result.errorCode ? { errorCode: result.errorCode } : {}) };
+        return withPlan({ level, source: "error", summary, patterns, reasons, error: result.error, ...(result.errorCode ? { errorCode: result.errorCode } : {}) });
     }
     const answers = result.answers;
     const judgment = {
@@ -458,6 +495,13 @@ export async function evaluateAction(action, options) {
         judgment.approved = answers.approved.noul;
     if (typeof answers.mutates?.noul === "number")
         judgment.mutates = answers.mutates.noul;
+    if (plan && typeof answers.intent_mismatch?.noul === "number")
+        judgment.intentMismatch = answers.intent_mismatch.noul;
+    if (typeof answers.regretted?.noul === "number") {
+        judgment.regretted = answers.regretted.noul;
+        if (typeof answers.regret_target?.choice === "string")
+            judgment.regretTarget = answers.regret_target.choice;
+    }
     if (deferSensitive) {
         for (const hit of patterns) {
             if (hit.severity !== "sensitive")
@@ -499,7 +543,15 @@ export async function evaluateAction(action, options) {
             reasons.push(`possible security weakness ${percent(judgment.securityRisk)} in written content`);
         }
     }
-    const verdict = { level, source: "typesafe", summary, patterns, reasons, judgment };
+    // A call at odds with the agent's own plan is warned about and the agent is told; it is not held on that alone until the hold labels say how precise the signal is.
+    const mismatch = judgment.intentMismatch !== undefined && judgment.intentMismatch >= config.intentMismatch && canChange;
+    if (mismatch) {
+        level = higher(level, "warn");
+        reasons.push(`intent mismatch ${percent(judgment.intentMismatch)} (the call differs from the agent's stated plan)`);
+    }
+    const verdict = withPlan({ level, source: "typesafe", summary, patterns, reasons, judgment });
+    if (mismatch)
+        verdict.intentMismatch = true;
     if (options.slop?.enabled && SLOP_SYMPTOMS.every(symptom => typeof answers[`slop_${symptom}`]?.noul === "number")) {
         verdict.slop = { stub: answers.slop_stub.noul, comments: answers.slop_comments.noul, dead: answers.slop_dead.noul, hedging: answers.slop_hedging.noul };
         const flagged = SLOP_SYMPTOMS.filter(symptom => verdict.slop[symptom] >= options.slop.threshold).sort((a, b) => verdict.slop[b] - verdict.slop[a]);
@@ -515,6 +567,11 @@ export async function evaluateAction(action, options) {
     }
     return verdict;
 }
+/** What the agent reads after a call that differs from its own plan ran: name the gap, ask it to keep words and calls in step. */
+export function intentSteer(verdict) {
+    const score = verdict.judgment?.intentMismatch;
+    return `pi-warden: this ${verdict.summary.tool} call does something different from what you said you were about to do${score === undefined ? "" : ` (intent mismatch ${percent(score)})`}. It ran. Before the next call, say what changed and why, and keep your stated plan and your calls in step; if the described step is still needed, do it.`;
+}
 /** Offline stand-in for the approval question when TypeSafe is not available. */
 export function textApproves(task) {
     return /\b(?:yes|yep|yeah|go ahead|do it|proceed|approved?|confirm(?:ed)?|ok(?:ay)?|sure|please do|run it)\b/i.test(task ?? "") && !/\b(?:no|don't|do not|stop|wait|instead|not)\b/i.test(task ?? "");

package/dist/holds.d.ts

@@ -0,0 +1,123 @@
+import type { WardenMode } from "./config.js";
+import type { Level, PreviousAction, ScopeLabel, Verdict } from "./guard.js";
+/**
+ * Hold feedback loop. Every hold is a prediction ("this call should not run as it stands") and every allowed call the
+ * opposite one; what the user does next labels them, so hold precision can be measured on real sessions instead of the
+ * synthetic cases the thresholds came from:
+ *
+ * - **approved**: the user's reply released the hold (steer mode) or the confirm dialog allowed it. False positive.
+ * - **declined**: the confirm dialog refused it. True positive.
+ * - **replanned**: the user replied, the following turn ended, and nobody approved the call. True positive.
+ * - **regretted**: the user's next message tells the agent to stop, undo, or not do an allowed call. False negative.
+ * - **accepted**: the user's next message was checked and does not regret the allowed calls of the last turn.
+ *
+ * Approval, decline, and re-plan are code only. Regret is one question that rides the first action request under the
+ * new prompt (no extra request); offline a stop-word heuristic stands in. Calls the guard skipped as read-only are not
+ * recorded: they could never have been held. Records are redacted for the log: tool, pattern ids, scores, level,
+ * outcome, never the command or path. The in-memory summary serves the regret question and stays in memory.
+ */
+export type CallOutcome = "pending" | "approved" | "declined" | "replanned" | "regretted" | "accepted";
+export type OutcomeVia = "retry" | "dialog" | "next prompt" | "jev" | "text";
+export interface CallScores {
+    irreversible: number;
+    offTask: number;
+    scope: ScopeLabel;
+    mutates?: number;
+    approved?: number;
+    intentMismatch?: number;
+    securityRisk?: number;
+}
+export interface CallRecord {
+    /** Sequence number within the session; the regret question names candidates by it. */
+    id: number;
+    at: number;
+    tool: string;
+    level: Level;
+    source: Verdict["source"];
+    mode: WardenMode;
+    held: boolean;
+    patterns: string[];
+    /** Reason labels as shown to the user; they name patterns and scores, never the command. */
+    reasons: string[];
+    /** Length of the agent's stated plan sent with the call; 0 means the agent said nothing before calling. Decides whether declared intent (layer 2) is worth building. */
+    planChars: number;
+    scores?: CallScores;
+    outcome: CallOutcome;
+    outcomeAt?: number;
+    outcomeVia?: OutcomeVia;
+    /** P(regret) from the question that labelled this call, when Jev answered it. */
+    regret?: number;
+}
+export interface HoldSnapshot {
+    holds: number;
+    approved: number;
+    declined: number;
+    replanned: number;
+    /** Holds without a label yet: the user has not replied, or the turn after the reply is still running. */
+    awaiting: number;
+    allowed: number;
+    regretted: number;
+    accepted: number;
+    /** Labelled holds: approved + declined + replanned. */
+    labels: number;
+    /** (declined + replanned) / labels; undefined without labels. */
+    precision: number | undefined;
+}
+export declare class HoldLedger {
+    private readonly tracked;
+    private nextId;
+    /** One inspected call. `outcome` is set at once when the confirm dialog decided; a steer-mode hold starts pending. */
+    record(verdict: Verdict, options: {
+        held: boolean;
+        mode: WardenMode;
+        outcome?: CallOutcome | undefined;
+        via?: OutcomeVia | undefined;
+        at?: number;
+    }): CallRecord;
+    /**
+     * The user's reply released a hold: the pending hold of the same tool is the false positive, the latest one when the
+     * tools differ (the retry rarely repeats the held call byte for byte, and a hold can be released through another tool).
+     */
+    approved(tool: string, via?: OutcomeVia, at?: number): CallRecord | undefined;
+    /**
+     * A new user prompt. Every pending record has seen one more prompt. A hold still pending after the prompt that could
+     * have approved it (the reply) and the turn that followed is a re-plan: the agent found another way or the user said no.
+     */
+    promptArrived(at?: number): CallRecord[];
+    /** Allowed calls of the turn the user just replied to, oldest first: the calls the reply could regret. */
+    candidates(): PreviousAction[];
+    /**
+     * The reply was read. With regret, the located call (or the latest candidate) is the miss and the rest are accepted;
+     * without it, every candidate is accepted. Returns the records that changed.
+     */
+    regret(result: {
+        regretted: boolean;
+        target?: string | undefined;
+        probability?: number | undefined;
+        via: OutcomeVia;
+    }, at?: number): CallRecord[];
+    records(): readonly CallRecord[];
+    snapshot(): HoldSnapshot;
+    reset(): void;
+    private label;
+}
+/** Whether P(regret) from the question counts as regret. */
+export declare function regretsAt(probability: number): boolean;
+/** Offline stand-in for the regret question: the reply opens by stopping, undoing, or forbidding what was just done. */
+export declare function textRegrets(prompt: string | undefined): boolean;
+/** One line for the trace entry of a call whose outcome landed. */
+export declare function outcomeNote(record: CallRecord): string;
+/** One line for /warden status. */
+export declare function formatHolds(snapshot: HoldSnapshot, logPath?: string): string;
+/** Per-session file beside the user config: `<agent dir>/pi-warden/holds/<date>-<session>.jsonl`. */
+export declare function holdLogPath(sessionId: string, at?: Date): string;
+/** Rewrites the session's records as JSON lines, owner-only, one write at a time so outcomes never interleave. */
+export declare class HoldLog {
+    readonly path: string;
+    private queue;
+    private failure;
+    constructor(path: string);
+    save(records: readonly CallRecord[]): Promise<void>;
+    /** The last write error, if the most recent save failed. */
+    get lastFailure(): string | undefined;
+}

package/dist/holds.js

@@ -0,0 +1,196 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { userConfigPath } from "./config.js";
+const REGRET_THRESHOLD = 0.7;
+function scoresOf(verdict) {
+    const { judgment } = verdict;
+    if (!judgment)
+        return undefined;
+    const scores = { irreversible: judgment.irreversible, offTask: judgment.offTask, scope: judgment.scope };
+    if (judgment.mutates !== undefined)
+        scores.mutates = judgment.mutates;
+    if (judgment.approved !== undefined)
+        scores.approved = judgment.approved;
+    if (judgment.intentMismatch !== undefined)
+        scores.intentMismatch = judgment.intentMismatch;
+    if (judgment.securityRisk !== undefined)
+        scores.securityRisk = judgment.securityRisk;
+    return scores;
+}
+export class HoldLedger {
+    tracked = [];
+    nextId = 1;
+    /** One inspected call. `outcome` is set at once when the confirm dialog decided; a steer-mode hold starts pending. */
+    record(verdict, options) {
+        const at = options.at ?? Date.now();
+        const record = {
+            id: this.nextId++,
+            at,
+            tool: verdict.summary.tool,
+            level: verdict.level,
+            source: verdict.source,
+            mode: options.mode,
+            held: options.held,
+            patterns: verdict.patterns.map(hit => hit.id),
+            reasons: [...verdict.reasons],
+            planChars: verdict.plan?.length ?? 0,
+            outcome: options.outcome ?? "pending",
+        };
+        const scores = scoresOf(verdict);
+        if (scores)
+            record.scores = scores;
+        if (options.outcome && options.outcome !== "pending") {
+            record.outcomeAt = at;
+            if (options.via)
+                record.outcomeVia = options.via;
+        }
+        this.tracked.push({ record, summary: verdict.summary, prompts: 0 });
+        return record;
+    }
+    /**
+     * The user's reply released a hold: the pending hold of the same tool is the false positive, the latest one when the
+     * tools differ (the retry rarely repeats the held call byte for byte, and a hold can be released through another tool).
+     */
+    approved(tool, via = "retry", at = Date.now()) {
+        const pending = this.tracked.filter(item => item.record.held && item.record.outcome === "pending");
+        const match = pending.filter(item => item.record.tool === tool).at(-1) ?? pending.at(-1);
+        if (!match)
+            return undefined;
+        return this.label(match, "approved", via, at);
+    }
+    /**
+     * A new user prompt. Every pending record has seen one more prompt. A hold still pending after the prompt that could
+     * have approved it (the reply) and the turn that followed is a re-plan: the agent found another way or the user said no.
+     */
+    promptArrived(at = Date.now()) {
+        const changed = [];
+        for (const item of this.tracked) {
+            if (item.record.outcome !== "pending")
+                continue;
+            item.prompts++;
+            if (item.record.held && item.prompts >= 2)
+                changed.push(this.label(item, "replanned", "next prompt", at));
+        }
+        return changed;
+    }
+    /** Allowed calls of the turn the user just replied to, oldest first: the calls the reply could regret. */
+    candidates() {
+        return this.tracked
+            .filter(item => !item.record.held && item.record.outcome === "pending" && item.prompts === 1)
+            .map(item => ({
+            id: `a${item.record.id}`,
+            tool: item.summary.tool,
+            ...(item.summary.command !== undefined ? { command: clip(item.summary.command, 300) } : {}),
+            ...(item.summary.path !== undefined ? { path: item.summary.path } : {}),
+        }));
+    }
+    /**
+     * The reply was read. With regret, the located call (or the latest candidate) is the miss and the rest are accepted;
+     * without it, every candidate is accepted. Returns the records that changed.
+     */
+    regret(result, at = Date.now()) {
+        const candidates = this.tracked.filter(item => !item.record.held && item.record.outcome === "pending" && item.prompts === 1);
+        if (!candidates.length)
+            return [];
+        const target = result.regretted ? candidates.find(item => `a${item.record.id}` === result.target) ?? candidates.at(-1) : undefined;
+        return candidates.map(item => {
+            const record = this.label(item, item === target ? "regretted" : "accepted", result.via, at);
+            if (result.probability !== undefined)
+                record.regret = result.probability;
+            return record;
+        });
+    }
+    records() {
+        return this.tracked.map(item => item.record);
+    }
+    snapshot() {
+        const records = this.records();
+        const holds = records.filter(record => record.held);
+        const allowed = records.filter(record => !record.held);
+        const count = (list, outcome) => list.filter(record => record.outcome === outcome).length;
+        const approved = count(holds, "approved");
+        const declined = count(holds, "declined");
+        const replanned = count(holds, "replanned");
+        const labels = approved + declined + replanned;
+        return {
+            holds: holds.length, approved, declined, replanned, awaiting: count(holds, "pending"),
+            allowed: allowed.length, regretted: count(allowed, "regretted"), accepted: count(allowed, "accepted"),
+            labels, precision: labels ? (declined + replanned) / labels : undefined,
+        };
+    }
+    reset() {
+        this.tracked.length = 0;
+        this.nextId = 1;
+    }
+    label(item, outcome, via, at) {
+        item.record.outcome = outcome;
+        item.record.outcomeAt = at;
+        item.record.outcomeVia = via;
+        return item.record;
+    }
+}
+const clip = (text, limit) => (text.length <= limit ? text : `${text.slice(0, limit)}…`);
+/** Whether P(regret) from the question counts as regret. */
+export function regretsAt(probability) {
+    return probability >= REGRET_THRESHOLD;
+}
+/** Offline stand-in for the regret question: the reply opens by stopping, undoing, or forbidding what was just done. */
+export function textRegrets(prompt) {
+    const text = (prompt ?? "").trim();
+    if (!text)
+        return false;
+    const opening = text.slice(0, 160);
+    return /^(?:wait(?! (?:for|until|till)\b)|stop\b|nope\b|hold on\b|don[’']t\b|do not\b|undo\b|revert\b|roll ?back\b|why did you\b|you (?:shouldn[’']t|should not) have\b|that (?:was|is) (?:wrong|not what)\b|no[,.!])/i.test(opening)
+        || /\b(?:undo|revert|roll ?back) (?:that|this|it|the last|those|what you)\b/i.test(opening)
+        || /\b(?:don[’']t|do not|never) (?:do|run|touch|push|delete|remove|commit) that\b/i.test(opening);
+}
+/** One line for the trace entry of a call whose outcome landed. */
+export function outcomeNote(record) {
+    switch (record.outcome) {
+        case "approved": return `outcome: approved by the user (${record.outcomeVia === "dialog" ? "confirm dialog" : "released on retry"}); the hold was a false positive`;
+        case "declined": return "outcome: declined by the user in the confirm dialog; the hold stood";
+        case "replanned": return "outcome: never approved after the user replied; the agent re-planned, the hold stood";
+        case "regretted": return `outcome: the user's next message regrets this call${record.regret !== undefined ? ` (${record.regret.toFixed(2)})` : ""}; it should have been held`;
+        case "accepted": return `outcome: the user's next message does not regret this call${record.regret !== undefined ? ` (${record.regret.toFixed(2)})` : ""}`;
+        default: return "outcome: pending";
+    }
+}
+/** One line for /warden status. */
+export function formatHolds(snapshot, logPath) {
+    if (snapshot.holds === 0 && snapshot.allowed === 0)
+        return "Holds: no guarded call judged yet this session.";
+    const parts = [`${snapshot.holds} hold${snapshot.holds === 1 ? "" : "s"}`];
+    if (snapshot.holds)
+        parts.push(`${snapshot.approved} approved by you, ${snapshot.declined} declined, ${snapshot.replanned} re-planned, ${snapshot.awaiting} awaiting your reply`);
+    parts.push(snapshot.precision === undefined ? "precision not yet measurable" : `precision ${Math.round(snapshot.precision * 100)}% over ${snapshot.labels} label${snapshot.labels === 1 ? "" : "s"}`);
+    parts.push(`${snapshot.allowed} allowed (${snapshot.regretted} regretted by you, ${snapshot.accepted} accepted)`);
+    return `Holds: ${parts.join("; ")}.${logPath ? ` Log: ${logPath}.` : ""}`;
+}
+/** Per-session file beside the user config: `<agent dir>/pi-warden/holds/<date>-<session>.jsonl`. */
+export function holdLogPath(sessionId, at = new Date()) {
+    const day = at.toISOString().slice(0, 10);
+    const safe = sessionId.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 40) || String(process.pid);
+    return join(dirname(userConfigPath()), "holds", `${day}-${safe}.jsonl`);
+}
+/** Rewrites the session's records as JSON lines, owner-only, one write at a time so outcomes never interleave. */
+export class HoldLog {
+    path;
+    queue = Promise.resolve();
+    failure;
+    constructor(path) {
+        this.path = path;
+    }
+    save(records) {
+        const text = records.map(record => JSON.stringify(record)).join("\n") + (records.length ? "\n" : "");
+        this.queue = this.queue.then(async () => {
+            await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+            await writeFile(this.path, text, { mode: 0o600 });
+            this.failure = undefined;
+        }).catch(error => { this.failure = error instanceof Error ? error.message : String(error); });
+        return this.queue;
+    }
+    /** The last write error, if the most recent save failed. */
+    get lastFailure() {
+        return this.failure;
+    }
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { evaluateAction, describeAction, matchPatterns, isReadOnlyCommand, stripDataText, buildRequest, formatVerdict, steerReason, questions, slopQuestions, approvalQuestion, securityQuestion } from "./guard.js";
-export type { ActionInput, ActionSummary, EvaluateOptions, Judge, Judgment, SlopJudgment, SlopSymptom, Level, PatternHit, ScannedCommand, ScopeLabel, Severity, Verdict } from "./guard.js";
+export { evaluateAction, describeAction, describePlan, matchPatterns, isReadOnlyCommand, stripDataText, buildRequest, formatVerdict, steerReason, intentSteer, questions, intentQuestion, slopQuestions, approvalQuestion, securityQuestion, regretQuestions } from "./guard.js";
+export type { ActionInput, ActionSummary, EvaluateOptions, Judge, Judgment, SlopJudgment, SlopSymptom, Level, PatternHit, PreviousAction, ScannedCommand, ScopeLabel, Severity, Verdict } from "./guard.js";
 export { SLOP_SYMPTOMS, SLOP_LABELS } from "./guard.js";
 export { ActionGuard } from "./action-guard.js";
 export type { Conversation, InspectOptions, ToolCallRef } from "./action-guard.js";
@@ -22,6 +22,8 @@ export { RunawayMonitor, repeatedBlock, repeatedTail, findRepeats, runawayNudge,
 export type { RunawayVerdict, RepeatSignal, StreamKind } from "./runaway.js";
 export { completeConfig, shapeWarning, EXPECTED_SCHEMA } from "./shape.js";
 export { ContextLedger, formatLedger } from "./saver.js";
+export { HoldLedger, HoldLog, holdLogPath, formatHolds, outcomeNote, regretsAt, textRegrets } from "./holds.js";
+export type { CallOutcome, CallRecord, CallScores, HoldSnapshot, OutcomeVia } from "./holds.js";
 export type { ContextLedgerSnapshot, RecallKind } from "./saver.js";
 export type { ShapeResult } from "./shape.js";
 export { CONFIG_SCHEMA, defaultConfig, loadConfig, applyUserOverrides, applyProjectOverrides, isMode, isRecallTool, userConfigPath, projectConfigPath, readUserConfig, writeUserConfig, setUserSetting, PACKAGE_NAME } from "./config.js";

package/dist/index.js

@@ -1,4 +1,4 @@
-export { evaluateAction, describeAction, matchPatterns, isReadOnlyCommand, stripDataText, buildRequest, formatVerdict, steerReason, questions, slopQuestions, approvalQuestion, securityQuestion } from "./guard.js";
+export { evaluateAction, describeAction, describePlan, matchPatterns, isReadOnlyCommand, stripDataText, buildRequest, formatVerdict, steerReason, intentSteer, questions, intentQuestion, slopQuestions, approvalQuestion, securityQuestion, regretQuestions } from "./guard.js";
 export { SLOP_SYMPTOMS, SLOP_LABELS } from "./guard.js";
 export { ActionGuard } from "./action-guard.js";
 export { evaluateProse, buildProseRequest, proseQuestions, proseNudge, describeAudience, ProseTrend, PROSE_SYMPTOMS, PROSE_LABELS } from "./prose.js";
@@ -12,6 +12,7 @@ export { detectNotifier, notifierCommand, sendNotification, candidates as notifi
 export { RunawayMonitor, repeatedBlock, repeatedTail, findRepeats, runawayNudge, formatRunaway, BLOCK_MIN_CHARS, PHRASE_CHARS, CHECK_EVERY } from "./runaway.js";
 export { completeConfig, shapeWarning, EXPECTED_SCHEMA } from "./shape.js";
 export { ContextLedger, formatLedger } from "./saver.js";
+export { HoldLedger, HoldLog, holdLogPath, formatHolds, outcomeNote, regretsAt, textRegrets } from "./holds.js";
 export { CONFIG_SCHEMA, defaultConfig, loadConfig, applyUserOverrides, applyProjectOverrides, isMode, isRecallTool, userConfigPath, projectConfigPath, readUserConfig, writeUserConfig, setUserSetting, PACKAGE_NAME } from "./config.js";
 export { commandOf, outputReportsFailure, COMMAND_TOOLS } from "./tools.js";
 export { renderTemplate, actionTokens, stuckTokens, doneTokens, proseTokens, runawayTokens, rulesTokens, defaultWidgetConfig, DEFAULT_TEMPLATES, TOKEN_NAMES } from "./widget.js";

package/dist/shape.js

@@ -26,7 +26,7 @@ export function completeConfig(loaded) {
         timeoutMs: source.timeoutMs ?? 5000,
         maxRequests: source.maxRequests ?? 500,
         steerVisible: source.steerVisible ?? false,
-        action: section("action", { ...off, tools: [], failOpen: true, timeoutMs: 5000, irreversible: { warn: 1, confirm: 1 }, offTask: { warn: 1, confirm: 1 } }),
+        action: section("action", { ...off, tools: [], failOpen: true, timeoutMs: 5000, irreversible: { warn: 1, confirm: 1 }, offTask: { warn: 1, confirm: 1 }, intentMismatch: 1, feedbackLog: false }),
         stuck: section("stuck", { ...off, window: 12, minFailures: 3, cooldown: 3, sameStrategy: 1, nudge: false }),
         done: section("done", { ...off, claimsDone: 1, nudge: false }),
         slop: section("slop", { ...off, threshold: 1, prose: proseOff() }),
@@ -48,6 +48,11 @@ export function completeConfig(loaded) {
     }
     if (typeof config.widget.panelWidth !== "string" && typeof config.widget.panelWidth !== "number")
         config.widget = { ...config.widget, panelWidth: "40%" };
+    // The feedback log flag was added inside the action section later than the section itself; an older config module leaves it undefined and the log stays on.
+    if (typeof config.action.feedbackLog !== "boolean")
+        config.action = { ...config.action, feedbackLog: true };
+    if (typeof config.action.intentMismatch !== "number")
+        config.action = { ...config.action, intentMismatch: 0.8 };
     // The runaway guard added its template later than the other sections; an older widget section renders the default line.
     if (typeof config.widget.runaway !== "string")
         config.widget = { ...config.widget, runaway: DEFAULT_TEMPLATES.runaway };

package/dist/trace.d.ts

@@ -20,6 +20,8 @@ export declare class Trace {
     private readonly listeners;
     constructor(limit?: number);
     push(entry: TraceEntry): void;
+    /** Appends a detail line to an entry that is still in the trace, for an outcome that lands after the event. */
+    amend(entry: TraceEntry, line: string): boolean;
     entries(): readonly TraceEntry[];
     clear(): void;
     subscribe(listener: () => void): () => void;

package/dist/trace.js

@@ -13,6 +13,15 @@ export class Trace {
         for (const listener of this.listeners)
             listener();
     }
+    /** Appends a detail line to an entry that is still in the trace, for an outcome that lands after the event. */
+    amend(entry, line) {
+        if (!this.items.includes(entry))
+            return false;
+        entry.details.push(line);
+        for (const listener of this.listeners)
+            listener();
+        return true;
+    }
     entries() {
         return this.items;
     }
@@ -37,10 +46,12 @@ export function actionDetails(verdict, extra = {}) {
         lines.push(`${summary.tool} ${summary.path}${summary.location === "outside_project" ? " (outside the project)" : ""}${summary.exists === false ? " (new file)" : ""}${summary.bytes !== undefined ? ` · ${summary.bytes} bytes` : ""}${summary.editCount !== undefined ? ` · ${summary.editCount} edit${summary.editCount === 1 ? "" : "s"}` : ""}`);
     if (summary.input !== undefined)
         lines.push(`input: ${clip(summary.input, 300)}`);
+    if (verdict.plan !== undefined)
+        lines.push(`plan: ${clip(verdict.plan.replace(/\s+/g, " "), 300)}`);
     if (verdict.patterns.length)
         lines.push(`patterns: ${verdict.patterns.map(hit => `${hit.id} (${hit.severity})`).join(", ")}`);
     if (judgment) {
-        lines.push(`jev: irreversible ${percent(judgment.irreversible)} · off-task ${percent(judgment.offTask)} · ${judgment.scope.replace(/_/g, " ")} (${percent(judgment.scopeConfidence)})${judgment.approved !== undefined ? ` · approved ${percent(judgment.approved)}` : ""}${judgment.mutates !== undefined ? ` · mutates ${percent(judgment.mutates)}` : ""} · ${judgment.model} · ${judgment.elapsedMs} ms`);
+        lines.push(`jev: irreversible ${percent(judgment.irreversible)} · off-task ${percent(judgment.offTask)} · ${judgment.scope.replace(/_/g, " ")} (${percent(judgment.scopeConfidence)})${judgment.approved !== undefined ? ` · approved ${percent(judgment.approved)}` : ""}${judgment.mutates !== undefined ? ` · mutates ${percent(judgment.mutates)}` : ""}${judgment.intentMismatch !== undefined ? ` · intent mismatch ${percent(judgment.intentMismatch)}` : ""}${judgment.regretted !== undefined ? ` · regret of last turn ${percent(judgment.regretted)}` : ""} · ${judgment.model} · ${judgment.elapsedMs} ms`);
     }
     if (judgment?.securityRisk !== undefined)
         lines.push(`security risk: ${percent(judgment.securityRisk)}`);

package/dist/widget.d.ts

@@ -51,7 +51,7 @@ export declare const TOKEN_NAMES: {
     readonly context: readonly ["tool", "retention", "bytesSaved"];
     readonly runaway: readonly ["kind", "count", "chars", "signal", "block", "status", "time", "guard"];
     readonly rules: readonly ["tool", "path", "asked", "violations", "status", "source", "reasons", "model", "ms", "flags", "time", "guard"];
-    readonly action: readonly ["tool", "level", "source", "irreversible", "offTask", "scope", "approved", "slop", "slopStub", "slopComments", "slopDead", "slopHedging", "patterns", "reasons", "path", "model", "ms", "flags", "time", "guard"];
+    readonly action: readonly ["tool", "level", "source", "irreversible", "offTask", "scope", "approved", "intent", "plan", "slop", "slopStub", "slopComments", "slopDead", "slopHedging", "patterns", "reasons", "path", "model", "ms", "flags", "time", "guard"];
     readonly prose: readonly ["wordy", "cliches", "jargon", "status", "reasons", "model", "ms", "flags", "time", "guard"];
     readonly stuck: readonly ["failures", "sameStrategy", "approachChange", "progress", "status", "source", "reasons", "model", "ms", "flags", "time", "guard"];
     readonly done: readonly ["changes", "checks", "checksPassed", "claimsDone", "claimsVerified", "checksApply", "outcome", "status", "reasons", "model", "ms", "flags", "time", "guard"];

package/dist/widget.js

@@ -37,6 +37,7 @@ const time = (at) => new Date(at).toTimeString().slice(0, 8);
 export function actionTokens(verdict, at = Date.now()) {
     const flags = [
         verdict.approvedByUser ? "user approved" : undefined,
+        verdict.intentMismatch ? "off plan" : undefined,
         verdict.source === "error" ? "typesafe error" : undefined,
         verdict.source === "read-only" ? "read-only" : undefined,
     ].filter(Boolean).join(", ");
@@ -50,6 +51,8 @@ export function actionTokens(verdict, at = Date.now()) {
         offTask: fixed(verdict.judgment?.offTask),
         scope: verdict.judgment?.scope.replace(/_/g, " "),
         approved: fixed(verdict.judgment?.approved),
+        intent: fixed(verdict.judgment?.intentMismatch),
+        plan: verdict.plan === undefined ? undefined : (verdict.plan.length <= 80 ? verdict.plan : `${verdict.plan.slice(0, 80)}…`).replace(/\s+/g, " "),
         slop: verdict.slopSymptoms?.length ? verdict.slopSymptoms.map(symptom => `${symptom} ${verdict.slop[symptom].toFixed(2)}`).join(", ") : verdict.slop ? "none" : undefined,
         slopStub: fixed(verdict.slop?.stub),
         slopComments: fixed(verdict.slop?.comments),
@@ -149,7 +152,7 @@ export const TOKEN_NAMES = {
     context: ["tool", "retention", "bytesSaved"],
     runaway: ["kind", "count", "chars", "signal", "block", "status", "time", "guard"],
     rules: ["tool", "path", "asked", "violations", "status", "source", "reasons", "model", "ms", "flags", "time", "guard"],
-    action: ["tool", "level", "source", "irreversible", "offTask", "scope", "approved", "slop", "slopStub", "slopComments", "slopDead", "slopHedging", "patterns", "reasons", "path", "model", "ms", "flags", "time", "guard"],
+    action: ["tool", "level", "source", "irreversible", "offTask", "scope", "approved", "intent", "plan", "slop", "slopStub", "slopComments", "slopDead", "slopHedging", "patterns", "reasons", "path", "model", "ms", "flags", "time", "guard"],
     prose: ["wordy", "cliches", "jargon", "status", "reasons", "model", "ms", "flags", "time", "guard"],
     stuck: ["failures", "sameStrategy", "approachChange", "progress", "status", "source", "reasons", "model", "ms", "flags", "time", "guard"],
     done: ["changes", "checks", "checksPassed", "claimsDone", "claimsVerified", "checksApply", "outcome", "status", "reasons", "model", "ms", "flags", "time", "guard"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Guardrails for Pi built on pi-typesafe that steer the agent instead of interrupting you: Jev judges irreversible and off-task tool calls before they run, checks written code against your project rules, detects stuck loops, checks unverified done claims, and flags slop.",
   "type": "module",
   "license": "MIT",