pi-warden 1.7.0 → 1.11.2

package/dist/extension.js

@@ -6,7 +6,7 @@ import { CONFIG_DIR_NAME, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { defaultHostDirs } from "./host-dirs.js";
 import * as tuiModule from "@earendil-works/pi-tui";
 const MouseRegion = tuiModule.MouseRegion;
-import { authState, backendHost, createTypeSafe, describeAuth, resolveBackend, ask } from "pi-typesafe";
+import { authState, backendHost, createTypeSafe, describeAuth, resolveBackend, chunkEvaluationRequest } from "pi-typesafe";
 import { ensureApiKey } from "pi-typesafe/ui";
 import { backendName, describeBackend, disclosureFor, judgeOptions, loginStoresKey } from "./backend.js";
 import { ActionGuard } from "./action-guard.js";
@@ -17,7 +17,7 @@ import * as configModule from "./config.js";
 import { applyUserOverrides, defaultConfig, getNestedValue, isMode, loadConfig, PACKAGE_NAME, parseConfigValue, PROJECT_CONFIG_FILE, projectConfigPath, readUserConfig, setNestedValue, setUserSetting, userConfigPath, writeUserConfig } from "./config.js";
 import { checkSkipReason, classifyToolResult, doneNudge, emptyEvidence, evaluateDone, finalAssistantText, formatDone, isVisualCheck, localUrl, needsDoneCheck, projectCheckCommand, recordOutcome as recordDoneOutcome, recordUi } from "./done.js";
 import { causeNudge, causePreFilter, emptyCauseActivity, evaluateCause, formatCause, recordCauseActivity } from "./cause.js";
-import { createdScratch, describeAsked, evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, largeOutputNotice, movedInTargets, offTaskSteer, pruneScratch, scratchCandidates, SCRATCH_PATHS_ENV, scratchPaths, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, wardenHostPaths, writeSinkTargets, isVisibleCommand } from "./guard.js";
+import { createdScratch, describeAsked, evaluateAction, formatVerdictTokens, higher, inertPathRules, intentSteer, largeOutputNotice, movedInTargets, offTaskSteer, pruneScratch, scratchCandidates, SCRATCH_PATHS_ENV, scratchPaths, scoreFreeReason, shouldProceedMessage, SLOP_LABELS, SteerRepeatWindow, steerReason, stripDataText, unknownExemptIds, wardenHostPaths, writeSinkTargets, isVisibleCommand } from "./guard.js";
 import { commandOf } from "./tools.js";
 import { mergeWrites, shellWrites } from "./shell-writes.js";
 import { formatHolds, HoldLedger, HoldLog, holdLogPath, mutatingCall, outcomeNote, regretsAt, textRegrets } from "./holds.js";
@@ -27,7 +27,7 @@ import { compressOutput, duplicateNote, evaluateOutput, isGenericExcerpt, mergeO
 import { filterOutput } from "./filter.js";
 import { classifyRecall, detectSearchTool, recallInstruction } from "./recall.js";
 import { maskSecrets, redact } from "./redact.js";
-import { formatRules, pathNoteSteer, projectPath, RulesGuard, rulesSteer, RULES_FILE, FALLBACK_FILES, turnRulesFor } from "./rules.js";
+import { askChunks, formatRules, pathNoteSteer, projectPath, questionLimit, RulesGuard, rulesSteer, RULES_FILE, FALLBACK_FILES, turnRulesFor } from "./rules.js";
 import { evaluateTurnRun, SHELL_RULES_CHECKS, snapshotTree, turnSteer } from "./turn-rules.js";
 import { checkRules, formatRulesCheck } from "./rules-lint.js";
 import { parseRulesAuditArgs, parseBenchArgs, runRulesAudit, runBench, formatRulesAudit, formatBench } from "./rules-audit.js";
@@ -50,11 +50,12 @@ import { openConfigPanel, openTracePanel } from "./panel.js";
 import { completeConfig, shapeWarning, taskSpine } from "./shape.js";
 import { ContextLedger, formatFilterLedger, formatLedger } from "./saver.js";
 import { buildCuratorRequest, curatedRuleList, curatedRules, CURATOR_TIMEOUT_MS, CURATOR_TYPE, CuratorLedger, formatCuratedRules, formatCurator, ruleScores } from "./curator.js";
-import { SeenText, collapseRuns, seenItem } from "./dedupe.js";
+import { SeenText, collapseRuns, savedResultIn, seenItems } from "./dedupe.js";
 import { buildCompactSnapshot, compactAppendix, recallText } from "./compact.js";
 import { formatCompaction, relevanceCompaction } from "./relevance.js";
 import { applyLoopAction, formatLoopsForUser, formatOpenLoops, LOOP_ACTIONS, LOOP_CHARS, loopsFingerprint, loopsPath, openLoops, readLoops, updateLoops } from "./loops.js";
 import { changePrefsStore, emptyWordCounts, evaluatePrefs, forgetPref, formatPrefs, LESSON_CHARS, prefsMessage, prefsStorePath, readPrefsStore, recordLesson, scanPreferences } from "./prefs.js";
+import { armFor, isSuppressed, steerDeliveryKind, TRIAL_ENTRY_TYPE, trialText } from "./trial.js";
 import { formatWake, newReports, reportLabel, triageReport, WakePolicy } from "./subagent.js";
 import { actionDetails, causeDetails, doneDetails, proseDetails, rulesDetails, runawayDetails, stuckDetails, Trace } from "./trace.js";
 import { TraceFile, judgmentsState, traceDir, traceFilePath } from "./trace-file.js";
@@ -340,6 +341,9 @@ export function guardCurrentSections(result) {
         config.subagent = { ...config.subagent, observer: false };
     if (typeof config.widget.subagent !== "string")
         config.widget = { ...config.widget, subagent: DEFAULT_TEMPLATES.subagent };
+    // The trial section is new and off by default: a stale shape module hands the config over without it, and no delivery changes.
+    if (typeof config.trial !== "object" || config.trial === null || typeof config.trial.silentHalf !== "boolean")
+        config.trial = { silentHalf: false };
     return { config, missing };
 }
 /** Native Pi registration; importing the root library does not load this module. */
@@ -443,6 +447,38 @@ export default function wardenExtension(host) {
     let holdLog;
     /** The session id of the open session; every hold row of it carries it. */
     let activeSessionId;
+    /** The silent-half trial arm of the open session: "live" unless the user turned the trial on and the id hashed silent. */
+    let trialArm = "live";
+    /**
+     * One line of the trial record, appended as a custom session entry: Pi keeps it in the session log and never adds it
+     * to the model's context. A host without the entry API keeps the session running; the failure is local and loud once.
+     */
+    let trialRecordFailed = false;
+    const appendTrial = (record) => {
+        try {
+            if (typeof pi.appendEntry === "function")
+                pi.appendEntry(TRIAL_ENTRY_TYPE, record);
+            else if (!trialRecordFailed) {
+                trialRecordFailed = true;
+                console.warn("pi-warden: the host has no appendEntry; the trial record cannot be written");
+            }
+        }
+        catch (error) {
+            if (trialRecordFailed)
+                return;
+            trialRecordFailed = true;
+            console.warn("pi-warden: trial record failed:", error instanceof Error ? error.message : String(error));
+        }
+    };
+    /** Whether the silent arm withholds this delivery; a withheld delivery is recorded, redacted and clipped to 300 chars. */
+    const trialHolds = (kind, guard, text) => {
+        if (trialArm !== "silent" || !isSuppressed(kind))
+            return false;
+        appendTrial({ v: 1, record: "suppressed", kind, guard, at: Date.now(), text: trialText(redact(text)) });
+        return true;
+    };
+    /** The same test for a delivery whose kind is not yet narrowed; false keeps it live. */
+    const trialHoldsKind = (kind, guard, text) => trialArm === "silent" && isSuppressed(kind) ? trialHolds(kind, guard, text) : false;
     // Local rules verdict log for this session; a write failure is silent to the agent and shown once in the trace.
     let rulesLog;
     // Allowed calls of the turn the user just replied to; the regret question about them rides the next action request.
@@ -609,6 +645,8 @@ export default function wardenExtension(host) {
             const last = [...branch].reverse().find(entry => entry.type === "custom_message" && entry.customType === LOOPS_TYPE);
             if (last?.content === content)
                 return;
+            if (trialHolds("loops", "loops", content))
+                return;
             pi.sendMessage({ customType: LOOPS_TYPE, content, display: config.steerVisible });
         }
         catch (error) {
@@ -897,7 +935,7 @@ export default function wardenExtension(host) {
         const manager = ctx.sessionManager;
         // Compaction-aware when the host has it: text a compaction summarized is no longer in context, so nothing may point to it.
         const entries = typeof manager.buildContextEntries === "function" ? manager.buildContextEntries() : typeof manager.getBranch === "function" ? manager.getBranch() : [];
-        seenText.sync(entries.map(seenItem).filter(item => item !== undefined));
+        seenText.sync(seenItems(entries, ctx.model?.provider));
     };
     /** `text` with each run that repeats context replaced by a pointer line, or undefined when nothing repeats or the copy cannot be stored. */
     const dedupeText = async (ctx, config, text, source) => {
@@ -1044,7 +1082,14 @@ export default function wardenExtension(host) {
         }
         stats.steers++;
         steersThisRun++;
-        const { display, ...delivery } = options ?? { deliverAs: "steer" };
+        const { display, kind, ...delivery } = options ?? {};
+        // A call site that names only a kind, or nothing, keeps the old default; one that passes its own delivery options keeps them exactly.
+        if (delivery.deliverAs === undefined && delivery.triggerTurn === undefined)
+            delivery.deliverAs = "steer";
+        // The silent arm records what it would have said and sends nothing, after the same budget and repeat checks as
+        // the live arm, so both arms spend a run's steers alike.
+        if (trialHoldsKind(kind ?? steerDeliveryKind(names[0] ?? "action"), names.join(", "), content))
+            return false;
         pi.sendMessage({ customType: `${PACKAGE_NAME}-steer`, content, display: display ?? config.steerVisible }, delivery);
         if (delivery.triggerTurn)
             wardenContinuation = true;
@@ -1062,6 +1107,8 @@ export default function wardenExtension(host) {
         const notices = pendingNotices;
         pendingNotices = [];
         for (const notice of notices) {
+            if (trialHolds(notice.customType === CURATOR_TYPE ? "turn-rules" : "conscience", notice.guard, notice.content))
+                continue;
             pi.sendMessage({ customType: notice.customType, content: notice.content, display: config.steerVisible }, { deliverAs: "steer" });
             record(ctx, config, notice.guard, notice.delivered, notice.details);
         }
@@ -1288,6 +1335,7 @@ export default function wardenExtension(host) {
         regretCandidates = [];
         const sessionId = typeof ctx.sessionManager.getSessionId === "function" ? ctx.sessionManager.getSessionId() : String(process.pid);
         activeSessionId = sessionId;
+        trialArm = "live";
         holdLog = new HoldLog(holdLogPath(sessionId, new Date(), dirs));
         rulesLog = new RulesLog(ctx.cwd, sessionId, { path: rulesLogPath(ctx.cwd, dirs), onFailure: message => record(ctx, loadConfig({ dirs }), "rules", "rules log write failed", [message]) });
         unsubscribeTraceFile?.();
@@ -1389,6 +1437,13 @@ export default function wardenExtension(host) {
                 pi.sendMessage({ customType: `${PACKAGE_NAME}-status`, content: msg, display: true });
         }
         const opening = configFor(ctx);
+        // ── Silent-half trial ──
+        // The arm is fixed for the whole session from its id, so a resume or reload keeps it. With the setting off, no
+        // record is written and no delivery changes; only the user's config file can turn it on.
+        if (opening.trial.silentHalf === true) {
+            trialArm = armFor(sessionId);
+            appendTrial({ v: 1, record: "arm", arm: trialArm, sessionId, at: Date.now() });
+        }
         // A resumed or reloaded session already carries the message; sending it again would repeat it in the context.
         const openingBranch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
         const prefsSent = openingBranch.some(entry => entry.type === "custom_message" && entry.customType === PREFS_TYPE);
@@ -1396,7 +1451,7 @@ export default function wardenExtension(host) {
             try {
                 const message = prefsMessage((await evaluatedPrefs(ctx)).items);
                 // Not a steer; one message per session; do not spend a steer unit.
-                if (message)
+                if (message && !trialHolds("prefs", "prefs", message))
                     pi.sendMessage({ customType: PREFS_TYPE, content: message, display: opening.steerVisible });
             }
             catch (error) {
@@ -1414,6 +1469,17 @@ export default function wardenExtension(host) {
      * says why in the trace, and an answer that arrives after the run ended is dropped, also with a trace line.
      */
     const curateTurnStart = (ctx, config, prompt) => {
+        // A newer Pi also fires this event for a run a custom message starts (pi.sendMessage with triggerTurn), and that
+        // run has no operator prompt. There is no request to judge for rule relevance, so the reminder skips with a trace
+        // line instead of crashing on `undefined`, like the skips below.
+        if (typeof prompt !== "string") {
+            record(ctx, config, "rules", "warden · rules · turn start · skipped", [
+                "trigger: before_agent_start",
+                "skipReason: custom_trigger",
+                "the run started from a custom message, not an operator prompt; no rule question was sent",
+            ]);
+            return;
+        }
         // A prompt the conscience already skips needs no rules reminder either: a short continuation or a relayed child
         // report carries no work of its own, so no question is sent. The reason is traced either way.
         const gated = redact(prompt).slice(0, 2000);
@@ -1453,7 +1519,7 @@ export default function wardenExtension(host) {
         const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
         const request = buildCuratorRequest(prompt, taskSpine(branch, prompt), rules);
         const started = Date.now();
-        void ask(judge, request, { timeoutMs: Math.min(config.timeoutMs, CURATOR_TIMEOUT_MS), ...(ctx.signal ? { signal: ctx.signal } : {}) })
+        void askChunks(judge, chunkEvaluationRequest(request, { maxQuestions: questionLimit(judge) }), { timeoutMs: Math.min(config.timeoutMs, CURATOR_TIMEOUT_MS), ...(ctx.signal ? { signal: ctx.signal } : {}) })
             .then(answer => {
             const elapsedMs = Date.now() - started;
             // The run this request belonged to has ended: nothing may be appended after it (a delivery must never start a turn).
@@ -1528,14 +1594,20 @@ export default function wardenExtension(host) {
         // re-append the same text, which is what keeps it in the prompt instead of being diffed away.
         const wasteOptions = event.systemPromptOptions;
         if (config.enabled && config.waste.enabled && config.waste.tip && wasteOptions) {
-            wasteOptions.appendSystemPrompt = withWasteTip(wasteOptions.appendSystemPrompt);
+            // The silent arm withholds the tip and records it once, the way the live arm traces it once.
+            const held = trialArm === "silent";
+            if (held && !wasteTipOffered)
+                trialHolds("waste", "waste", WASTE_TIP);
+            if (!held)
+                wasteOptions.appendSystemPrompt = withWasteTip(wasteOptions.appendSystemPrompt);
             if (!wasteTipOffered) {
                 wasteTipOffered = true;
-                record(ctx, config, "waste", "warden · waste · session tip · instructions_supplied", [
-                    "trigger: before_agent_start",
-                    "delivery: appended to the system prompt (appendSystemPrompt)",
-                    `tip: ${WASTE_TIP}`,
-                ]);
+                if (!held)
+                    record(ctx, config, "waste", "warden · waste · session tip · instructions_supplied", [
+                        "trigger: before_agent_start",
+                        "delivery: appended to the system prompt (appendSystemPrompt)",
+                        `tip: ${WASTE_TIP}`,
+                    ]);
             }
         }
         fullOutputs = new Map();
@@ -1578,6 +1650,17 @@ export default function wardenExtension(host) {
                 loadedSkillNames = new Set();
                 queuedRevision++;
                 clearFileIdentityCache();
+                // The same custom-message case as the rules reminder: no operator prompt, nothing to assess. The state above
+                // still resets, so nothing from an older prompt leaks into a later one.
+                const prompt = event.prompt;
+                if (typeof prompt !== "string") {
+                    record(ctx, config, "conscience", "warden · conscience · turn start · skipped", [
+                        "trigger: before_agent_start",
+                        "skipReason: custom_trigger",
+                        "the run started from a custom message, not an operator prompt; no assessment was sent",
+                    ]);
+                    return;
+                }
                 const judge = judgeFor(config);
                 // Get the resolved skill catalog from the event's system prompt options (spec §3 rule 1)
                 const skills = event.systemPromptOptions?.skills ?? [];
@@ -1590,17 +1673,17 @@ export default function wardenExtension(host) {
                     toolInfos = [];
                 }
                 // Detect explicit /skill:name invocation (spec §3 rule 5)
-                const explicitSkillMatch = event.prompt.match(/\/skill:([\w-]+)/);
+                const explicitSkillMatch = prompt.match(/\/skill:([\w-]+)/);
                 if (explicitSkillMatch) {
                     record(ctx, config, "conscience", `explicit skill invocation: ${explicitSkillMatch[1]}`, ["trigger: input", `explicit_skill: ${explicitSkillMatch[1]}`]);
                 }
                 else {
                     // Redact and truncate prompt to 2000 chars (spec §6 payload limit)
-                    const redactedPrompt = redact(event.prompt).slice(0, 2000);
-                    const truncationRecorded = event.prompt.length > 2000 ? [`prompt truncated from ${event.prompt.length} to 2000 chars`] : [];
+                    const redactedPrompt = redact(prompt).slice(0, 2000);
+                    const truncationRecorded = prompt.length > 2000 ? [`prompt truncated from ${prompt.length} to 2000 chars`] : [];
                     // Build recent context from session branch (up to 4 messages, 500 chars each)
                     const branch = typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [];
-                    const spine = taskSpine(branch, event.prompt);
+                    const spine = taskSpine(branch, prompt);
                     const recentMessages = [];
                     for (const entry of branch.slice(-6)) {
                         if (recentMessages.length >= 4)
@@ -1660,7 +1743,7 @@ export default function wardenExtension(host) {
                         // The evaluate result carries the model that answered; the activation gate compares the policy's model against
                         // it. Empty until the first evaluate call, and an empty model never matches a policy, so the gate fails closed.
                         let judgeModel = "";
-                        const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
+                        const judgeAdapter = judge ? { limits: judge.limits, evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
                         const result = await assess(redactedPrompt, recentContext, skills, toolInfos, activeSkills, suppliedSkills, { judge: judgeAdapter, judgmentsOff: judgmentsOffReason(config), config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                         // Check generation and run after await: a result that belongs to an ended or replaced run must not deliver.
                         if (conscienceGeneration !== myGeneration || myPrompt !== promptEpoch || !agentRunActive) {
@@ -1814,7 +1897,7 @@ export default function wardenExtension(host) {
                         toolInfos = [];
                     }
                     const activeSkills = cachedSkills.map(s => s.name);
-                    const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
+                    const judgeAdapter = judge ? { limits: judge.limits, evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                     try {
                         const result = await assess(redactedText, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                         if (conscienceGeneration !== myGeneration)
@@ -1917,7 +2000,7 @@ export default function wardenExtension(host) {
                 const redactedPrompt = redact(prompt ?? "").slice(0, 2000);
                 const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
                 const activeSkills = cachedSkills.map(s => s.name);
-                const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
+                const judgeAdapter = judge ? { limits: judge.limits, evaluate: async (req) => { const r = await judge.evaluate(req); return { answers: r.answers }; } } : undefined;
                 try {
                     const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                     if (conscienceGeneration !== myGeneration)
@@ -2091,6 +2174,8 @@ export default function wardenExtension(host) {
         }
         const deliveryVerdict = agentDeliveryVerdict(verdict);
         const deliveryReasons = deliveryVerdict.reasons;
+        // The agent reads reasons without their scores; the trace, holds, and learning records keep them.
+        const agentReasons = deliveryReasons.map(scoreFreeReason);
         if (regretCandidates.length && verdict.judgment?.regretted !== undefined) {
             settleRegret(config, { regretted: regretsAt(verdict.judgment.regretted), target: verdict.judgment.regretTarget, probability: verdict.judgment.regretted, via: "jev" });
         }
@@ -2279,7 +2364,7 @@ export default function wardenExtension(host) {
             }
             notes.push(...pathNotes);
             if (notes.length) {
-                const delivered = steer(config, [...noteGuards], notes.join("\n\n"));
+                const delivered = steer(config, [...noteGuards], notes.join("\n\n"), { kind: "action-notes" });
                 const notePath = verdict.summary.path ?? shell?.writes[0]?.path;
                 if (delivered)
                     watchSteer(ctx, config, noteKinds, notePath ? { path: notePath } : {});
@@ -2291,7 +2376,7 @@ export default function wardenExtension(host) {
         const warnSteer = (reasons) => {
             if (!reasons.length || !adaptiveSend(ctx, config, "warn-headless"))
                 return false;
-            const sent = steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`);
+            const sent = steer(config, "action", `pi-warden: this ${event.toolName} call ran with a warning (${reasons.map(scoreFreeReason).join("; ")}). Nobody sees this in a headless run, so it is on you: if the flagged risk is expected, continue; otherwise fix it or ask the user before building on it.`, { kind: "warn-headless" });
             if (sent)
                 watchSteer(ctx, config, ["warn-headless"]);
             return sent;
@@ -2315,7 +2400,7 @@ export default function wardenExtension(host) {
             if (ctx.hasUI && config.notices)
                 ctx.ui.notify(`warden · blocked ${event.toolName}: ${verdict.reasons.join("; ")}`, "error");
             notifyDesktop(ctx, config, `Blocked ${event.toolName}: ${verdict.reasons.join("; ")}. A deny rule matched; the call never ran.`);
-            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${deliveryReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
+            return { block: true, reason: `pi-warden blocked this ${event.toolName} call (${agentReasons.join("; ")}). A deny rule matched; this command is not allowed to run. Ask the user if this is genuinely required.` };
         }
         if (verdict.level !== "confirm") {
             deliverNotes(true);
@@ -2323,7 +2408,7 @@ export default function wardenExtension(host) {
             return undefined;
         }
         const reasons = verdict.reasons.join("; ");
-        const deliveredReasons = deliveryReasons.join("; ");
+        const deliveredReasons = agentReasons.join("; ");
         // A user-defined confirm rule prompts the user in every mode, advise included: the operator wrote the rule to be
         // asked. Advise mode keeps Jev holds advisory; it does not soften a prompt the operator asked for by name.
         // The action defaults to dialog at parse time (the reason one writes such a rule); hold restores steer semantics.
@@ -2533,7 +2618,8 @@ export default function wardenExtension(host) {
                 storedPath = earlier.path ?? await saveOutput(text);
                 const replacement = `${duplicateNote(text, earlier.tool)}\n\n${recallInstruction(recallTool, storedPath)}`;
                 const bytesSaved = Buffer.byteLength(text) - Buffer.byteLength(replacement);
-                if (bytesSaved > 0) {
+                // The silent arm records the duplicate note and leaves the tool result whole.
+                if (bytesSaved > 0 && !trialHolds("context-compression", "context", replacement)) {
                     content = content.map(part => part.type === "text" ? { ...part, text: replacement } : part);
                     ledger.duplicate(bytesSaved);
                     ledger.remember(key, earlier.tool, storedPath);
@@ -2591,6 +2677,9 @@ export default function wardenExtension(host) {
                 }
                 if (!compressed && verdict.confidence !== undefined)
                     recordKeptWhole(config, event.toolName, verdict, `text block ${textIndex} of ${blockVerdicts.length}: `);
+                // The silent arm records the compressed block and leaves the original, with its security banner, in place.
+                if (compressed && replacement && trialHolds("context-compression", "context", replacement))
+                    replacement = undefined;
                 if (!replacement && blockNotice)
                     replacement = `${blockNotice}\n\n${blockText}\n\n${blockNotice}`;
                 if (replacement)
@@ -2609,7 +2698,9 @@ export default function wardenExtension(host) {
                     const replacement = `${filtered?.ok ? filtered.text : excerpt}\n\n${recallInstruction(recallTool, path)}`;
                     const bytesSaved = Buffer.byteLength(text) - Buffer.byteLength(replacement) - (notice ? Buffer.byteLength(notice) * 2 + 4 : 0);
                     if (bytesSaved > 0) {
-                        content = content.map(part => part.type === "text" ? { ...part, text: replacement } : part);
+                        // The silent arm records the excerpt and leaves the tool result whole; the security banner is placed below.
+                        if (!trialHolds("context-compression", "context", replacement))
+                            content = content.map(part => part.type === "text" ? { ...part, text: replacement } : part);
                         compressed = true;
                         ledger.record(path, bytesSaved, { tool: event.toolName, bytes: Buffer.byteLength(text), kind: filtered?.ok ? "filtered" : generic ? "excerpt" : "parser", ...(filtered?.ok ? { keptChars: filtered.keptChars } : {}) });
                         storedPath = path;
@@ -2631,11 +2722,12 @@ export default function wardenExtension(host) {
             if (!compressed && !ctx.signal?.aborted && output.confidence !== undefined)
                 recordKeptWhole(config, event.toolName, output);
         }
-        // A recall brings the stored text back on purpose, and a duplicate note has nothing left to cut.
-        if (config.context.enabled && config.context.dedupeRuns && !earlier && !recallRead && !ctx.signal?.aborted) {
+        // A recall brings the stored text back on purpose, and a duplicate note has nothing left to cut. A result the
+        // provider saved to a file never reached the model, so a read of that file is never a repeat.
+        if (config.context.enabled && config.context.dedupeRuns && !earlier && !recallRead && !savedResultIn(JSON.stringify(event.input), ctx.model?.provider) && !ctx.signal?.aborted) {
             syncSeen(ctx);
             const deduped = await dedupeContent(ctx, config, content, event.toolName);
-            if (deduped)
+            if (deduped && !trialHolds("context-compression", "context", `repeated runs collapsed in a ${event.toolName} result`))
                 content = deduped;
         }
         if (key && !earlier)
@@ -2675,7 +2767,7 @@ export default function wardenExtension(host) {
                     const saved = await saveOutput(text);
                     const diffNote = stuckDiff(prevEntry.text, text, { diffLimit: config.stuck.diffLimit, tailLimit: config.stuck.tailLimit, fullPath: saved });
                     const currentLen = Buffer.byteLength(content.map(part => part.type === "text" ? part.text : "").join("\n"));
-                    if (Buffer.byteLength(diffNote) < currentLen) {
+                    if (Buffer.byteLength(diffNote) < currentLen && !trialHolds("context-compression", "context", diffNote)) {
                         content = [{ type: "text", text: diffNote }, ...content.filter(part => part.type !== "text")];
                     }
                     fullOutputs.set(currentKey, { text, path: saved });
@@ -2689,7 +2781,7 @@ export default function wardenExtension(host) {
                 // Byte-identical outputs: one-line note reusing the existing saved path.
                 const diffNote = stuckDiff(text, text, { diffLimit: config.stuck.diffLimit, tailLimit: config.stuck.tailLimit, fullPath: prevEntry.path });
                 const currentLen = Buffer.byteLength(content.map(part => part.type === "text" ? part.text : "").join("\n"));
-                if (Buffer.byteLength(diffNote) < currentLen) {
+                if (Buffer.byteLength(diffNote) < currentLen && !trialHolds("context-compression", "context", diffNote)) {
                     content = [{ type: "text", text: diffNote }, ...content.filter(part => part.type !== "text")];
                 }
             }
@@ -2709,6 +2801,8 @@ export default function wardenExtension(host) {
         const withWaste = (current) => {
             if (!wasteNudge)
                 return current;
+            if (trialHolds("waste", "waste", wasteNudge.text))
+                return current;
             const base = current?.content ?? event.content;
             const lastText = base.reduce((last, part, index) => part.type === "text" ? index : last, -1);
             if (lastText < 0)
@@ -2798,10 +2892,12 @@ export default function wardenExtension(host) {
         const source = message.role === "custom" ? `${message.customType} message` : "user message";
         if (typeof message.content === "string") {
             const text = await dedupeText(ctx, config, message.content, source);
-            return text === undefined ? undefined : { message: { ...message, content: text } };
+            if (text === undefined || trialHolds("context-compression", "context", text))
+                return undefined;
+            return { message: { ...message, content: text } };
         }
         const content = await dedupeContent(ctx, config, message.content, source);
-        return content ? { message: { ...message, content } } : undefined;
+        return content && !trialHolds("context-compression", "context", `repeated runs collapsed in a ${source}`) ? { message: { ...message, content } } : undefined;
     });
     // The agent has caught up and Pi will not continue on its own: the one moment a wake costs the user nothing.
     pi.on("agent_settled", async (_event, ctx) => {
@@ -2843,7 +2939,8 @@ export default function wardenExtension(host) {
             if (!appendix)
                 return;
             // Not a steer; one message per compaction; do not spend a steer unit.
-            pi.sendMessage({ customType: `${PACKAGE_NAME}-compact-evidence`, content: appendix, display: config.steerVisible });
+            if (!trialHolds("compact-evidence", "context", appendix))
+                pi.sendMessage({ customType: `${PACKAGE_NAME}-compact-evidence`, content: appendix, display: config.steerVisible });
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -2902,6 +2999,9 @@ export default function wardenExtension(host) {
             // Pi checks the signal only after the hook returns; an aborted compaction is not replaced.
             if (event.signal.aborted)
                 return fallback("aborted", [counts], stats);
+            // The silent arm records what the compaction would have kept and lets Pi's own summary run.
+            if (trialHolds("context-compression", "context", `relevance compaction kept ${stats.kept} of ${stats.candidates}`))
+                return undefined;
             compactions.replaced++;
             compactions.last = stats;
             record(ctx, config, "context", `warden · context · relevance compaction · kept ${stats.kept} of ${stats.candidates}`, [
@@ -3026,7 +3126,7 @@ export default function wardenExtension(host) {
             const spine = taskSpine(typeof ctx.sessionManager?.getBranch === "function" ? ctx.sessionManager.getBranch() : [], prompt ?? undefined);
             const activeSkills = cachedSkills.map(s => s.name);
             let judgeModel = "";
-            const judgeAdapter = judge ? { evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
+            const judgeAdapter = judge ? { limits: judge.limits, evaluate: async (req) => { const r = await judge.evaluate(req); judgeModel = r.model; return { answers: r.answers }; } } : undefined;
             try {
                 const result = await assess(redactedPrompt, "", cachedSkills, toolInfos, activeSkills, [], { judge: judgeAdapter, config: config.conscience, sharedTimeoutMs: config.timeoutMs, now: () => Date.now(), globalIndex: globalIndexFile, projectIndex: projectIndexFile }, spine);
                 if (conscienceGeneration !== myGeneration)
@@ -3913,8 +4013,9 @@ export default function wardenExtension(host) {
                     // Accept both the full format and entries-only; warden always writes the final metadata.
                     let globalResult = rawGlobal ? validateIndex(rawGlobal) : { file: undefined, rejections: [] };
                     let projectResult = rawProject ? validateIndex(rawProject) : { file: undefined, rejections: [] };
-                    // Entries-only fallback: read raw JSON and extract entries array
-                    if (!globalResult.file && rawGlobal) {
+                    // Entries-only fallback: read raw JSON and extract entries array. It must not depend on rawGlobal/rawProject:
+                    // the strict read returns nothing for the entries-only shape the index prompt asks for.
+                    if (!globalResult.file) {
                         try {
                             const parsed = JSON.parse(readFileSync(globalPath, "utf8"));
                             if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
@@ -3927,7 +4028,7 @@ export default function wardenExtension(host) {
                                 record(ctx, config, "conscience", `global entries-only parse: ${msg}`, ["trigger: warden_index"]);
                         }
                     }
-                    if (!projectResult.file && rawProject) {
+                    if (!projectResult.file) {
                         try {
                             const parsed = JSON.parse(readFileSync(projectPath, "utf8"));
                             if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
@@ -3943,9 +4044,9 @@ export default function wardenExtension(host) {
                     }
                     // Collect rejections from both files
                     const allRejections = [];
-                    if (rawGlobal && !globalResult.file)
+                    if (!globalResult.file)
                         allRejections.push(...globalResult.rejections.map(r => `global index: entry ${r}`));
-                    if (rawProject && !projectResult.file)
+                    if (!projectResult.file)
                         allRejections.push(...projectResult.rejections.map(r => `project index: entry ${r}`));
                     if (allRejections.length > 0) {
                         report(`Index rejected:\n${allRejections.map(r => `  ${r}`).join("\n")}\nOld files kept.`, "warning");

package/dist/filter.d.ts

@@ -1,7 +1,8 @@
-import type { JsonValue, Judge } from "pi-typesafe";
+import type { JsonValue } from "pi-typesafe";
 import type { JudgmentsOffReason } from "./backend.js";
 import type { FilterConfig } from "./config.js";
 import type { TaskSpine } from "./shape.js";
+import type { LimitedJudge } from "./rules.js";
 /**
  * Context filter (beta, off by default). Where the saver would keep only the blind head/diagnostic/tail excerpt, Jev
  * scores line-bounded chunks of the output for the agent's current task, and code keeps the chunks that at least
@@ -15,7 +16,7 @@ export type FilterFallback = JudgmentsOffReason | "cooldown" | "timeout" | "erro
 export declare const FILTER_TAIL_CHARS = 1000;
 /** pi-typesafe refuses a request body over 64 KiB of JSON; the margin covers the model field and normalisation. */
 export declare const FILTER_REQUEST_BYTES = 60000;
-/** pi-typesafe's question limit per request. */
+/** pi-typesafe's question limit per request; a backend with a lower one gets its own. */
 export declare const FILTER_MAX_QUESTIONS = 32;
 export declare const FILTER_NOTE = "Passages selected for the current task; omitted text is in the full-output file.";
 export interface FilterInput {
@@ -30,7 +31,7 @@ export interface FilterInput {
 }
 export interface FilterOptions {
     config: FilterConfig;
-    judge: Judge;
+    judge: LimitedJudge;
     signal?: AbortSignal | undefined;
 }
 export type FilterResult = {
@@ -64,7 +65,7 @@ export declare function filterState(input: FilterInput): {
     [key: string]: JsonValue;
 };
 /** As few requests as the size and question limits allow; every chunk lands in exactly one, named `c<index+1>`. */
-export declare function buildFilterBatches(chunks: readonly string[], input: FilterInput, maxBytes?: number): Batch[];
+export declare function buildFilterBatches(chunks: readonly string[], input: FilterInput, maxBytes?: number, maxQuestions?: number): Batch[];
 /**
  * Chunks scoring at least `minScore`, in original order, within `maxKeptChars` including the tail. When more qualify
  * than fit, the highest scores win and the original order is restored. Returns the kept text with gap markers, or

package/dist/filter.js

@@ -1,4 +1,4 @@
-import { ask, score } from "pi-typesafe";
+import { ask, DEFAULT_BACKEND_LIMITS, score } from "pi-typesafe";
 import { redact } from "./redact.js";
 /**
  * Context filter (beta, off by default). Where the saver would keep only the blind head/diagnostic/tail excerpt, Jev
@@ -16,7 +16,7 @@ export const FILTER_RUBRIC = [
 export const FILTER_TAIL_CHARS = 1000;
 /** pi-typesafe refuses a request body over 64 KiB of JSON; the margin covers the model field and normalisation. */
 export const FILTER_REQUEST_BYTES = 60_000;
-/** pi-typesafe's question limit per request. */
+/** pi-typesafe's question limit per request; a backend with a lower one gets its own. */
 export const FILTER_MAX_QUESTIONS = 32;
 export const FILTER_NOTE = "Passages selected for the current task; omitted text is in the full-output file.";
 /** Chunks at line boundaries near `size`; a line is split only when it alone is longer than `size`. Joined, they are `text`. */
@@ -57,7 +57,7 @@ export function filterState(input) {
     };
 }
 /** As few requests as the size and question limits allow; every chunk lands in exactly one, named `c<index+1>`. */
-export function buildFilterBatches(chunks, input, maxBytes = FILTER_REQUEST_BYTES) {
+export function buildFilterBatches(chunks, input, maxBytes = FILTER_REQUEST_BYTES, maxQuestions = FILTER_MAX_QUESTIONS) {
     const base = filterState(input);
     const batches = [];
     let batch;
@@ -65,7 +65,7 @@ export function buildFilterBatches(chunks, input, maxBytes = FILTER_REQUEST_BYTE
     for (const [index, chunk] of chunks.entries()) {
         const id = `c${index + 1}`;
         const field = redact(chunk);
-        if (batch && batch.ids.length < FILTER_MAX_QUESTIONS) {
+        if (batch && batch.ids.length < Math.min(FILTER_MAX_QUESTIONS, maxQuestions)) {
             const next = { state: { ...batch.state, [id]: field }, questions: { ...batch.questions, [id]: question(id) }, ids: [...batch.ids, index] };
             if (size(next) <= maxBytes) {
                 batch = next;
@@ -149,7 +149,7 @@ export function filteredHeader(text) {
 export async function filterOutput(text, input, options) {
     const started = Date.now();
     const chunks = chunkLines(text, options.config.chunkChars);
-    const batches = buildFilterBatches(chunks, input);
+    const batches = buildFilterBatches(chunks, input, FILTER_REQUEST_BYTES, options.judge.limits?.maxQuestions ?? DEFAULT_BACKEND_LIMITS.maxQuestions);
     const results = await Promise.all(batches.map(batch => ask(options.judge, { state: batch.state, questions: batch.questions }, { timeoutMs: options.config.timeoutMs, ...(options.signal ? { signal: options.signal } : {}) })));
     const elapsedMs = Date.now() - started;
     const base = { chunks: chunks.length, requests: batches.length, elapsedMs };

package/dist/guard.d.ts

@@ -2,7 +2,7 @@ import type { Stats } from "node:fs";
 import type { IntegrationErrorCode, Judge, Questions } from "pi-typesafe";
 import type { ActionGuardConfig, ArmingRule, CommandRule, LargeOutputConfig, PathRule, RulesConfig, SecurityConfig, SlopGuardConfig } from "./config.js";
 import type { TaskSpine } from "./shape.js";
-import type { RulesSourceConfig } from "./rules.js";
+import type { LimitedJudge, RulesSourceConfig } from "./rules.js";
 import type { HostDirs } from "./host-dirs.js";
 import { type ScriptSource } from "./script-bodies.js";
 export type Level = "allow" | "warn" | "confirm" | "deny";
@@ -198,7 +198,7 @@ export type { Judge } from "pi-typesafe";
 export interface EvaluateOptions {
     config: ActionGuardConfig;
     /** Omit to run offline pattern checks only (no consent, no network). */
-    judge?: Judge | undefined;
+    judge?: LimitedJudge | undefined;
     signal?: AbortSignal | undefined;
     /** Adds quality questions for write/edit content to the same request. */
     slop?: SlopGuardConfig | undefined;
@@ -268,6 +268,14 @@ export interface ScannedCommand {
  * (`python3 - <<EOF`) are kept when the script calls out to a shell or process API.
  */
 export declare function stripDataText(command: string): ScannedCommand;
+/**
+ * The command text Jev and the pattern floor read: shell comments removed, and each backslash-newline the shell removes
+ * joined (outside quotes, in double quotes and `${…}`, and in a heredoc body with an unquoted delimiter); quotes,
+ * escapes, heredoc bodies, `$#`, `${#…}`, and a `#` mid-word kept. Quote state carries across lines. A construct the
+ * scan does not model (backticks, arithmetic, `case` inside `$(…)`, quotes inside `${…}`), or an unclosed quote,
+ * returns the command unchanged.
+ */
+export declare function stripShellComments(command: string): string;
 /**
  * Real paths this call moves or links data into, when the destination lies strictly inside a volatile temp root or a
  * scratch root the host declared. The session records them, so a later `rm` of a path equal to, inside, or above one is
@@ -681,9 +689,11 @@ export declare function largeOutputSteer(verdict: Verdict): string;
 export declare function largeOutputNotice(verdict: Verdict, steered: Set<string>): string | undefined;
 /** Offline stand-in for the approval question when TypeSafe is not available. */
 export declare function textApproves(task: string | undefined): boolean;
+/** A reason with its Jev score removed, for text the agent reads: the words stay, the number goes. */
+export declare function scoreFreeReason(reason: string): string;
 /**
  * The text the agent receives when a call is held. It explains the judgment and the two acceptable next moves,
- * so the model re-plans instead of retrying. Contains no command text (the model already has it) and no secrets.
+ * so the model re-plans instead of retrying. Contains no command text (the model already has it), no scores, and no secrets.
  */
 export declare function steerReason(verdict: Verdict, options: {
     canApprove: boolean;