pi-warden 0.60.0

pi-warden 0.60.0 is the first npm release since 0.48.1. It rolls up 0.49 to 0.60. See CHANGELOG.md for each change.

Safety fixes (upgrade recommended)

• A recursive delete of a root-like target can no longer be authorized by the task text. Before, a prompt containing / or . (for example "Clean up build/ please.") could authorize a recursive delete of /, ., or ./. Paths now match only as whole words, and root-like targets are never authorizable.

• Read-only fast path hardened:

  • git grep --open/-O (which run a program);
  • output-writing sort -o, uniq in out, tree -o, xxd -r;
  • process substitution;
  • git log/diff --output;
  • leading PATH=/LD_PRELOAD=-style assignments.

  None of these skips the judgment any more.

• Global git options are no longer a way around the rules. git -C dir reset --hard and git -C dir push --force are held.

• rm targets:

  • each target is paired with its own command segment;
  • quoted paths and redirects are handled;
  • authorizing one target never drops an unrelated hit;
  • a delete with no readable target (xargs rm -rf, find -delete) is authorized only by the exact command text.

• Credential masking now covers URL passwords, Authorization/Bearer values, and more token shapes.

• Symlinked index directories can no longer widen the writable host paths.

Less noise, less waiting

• A credential notice is sent only when a value was actually masked.
• sed -n prints and git list commands take the read-only fast path, with no judgment wait.
• git reset --hard with nothing uncommitted, and a lease push to the agent's own branch, warn instead of holding.
• The conscience no longer recommends core tools (read, bash, …), destructive tools, or tools for another platform. It sends no reminder after the agent has answered.
• The rules cap applies per file after path scoping, so scoped rule files no longer lose rules past 31.

New help for the agent

• Repeat steer: "you already ran npm test; it failed the same way." It fires on the second identical call, with no model request.
• Compaction memory: after compaction, the agent keeps what it tried that failed, the last passing check, and whether code changed since.
• UI proof: after a UI edit, a "done" claim needs a browser, screenshot, or device check.
• Shell-written code (cat <<EOF > file, echo … > file) is judged against your rules, like a write.
• /warden prefs lists preferences you repeated across sessions of a project. It is read-only. Set prefs.inject: true to give them to the agent at session start.
• /warden recommend now appears in completions.
• The trace records large-output scores, and the saver's verdicts on outputs it keeps whole.

Breaking

• RuleSet.dropped is replaced by RuleSet.alwaysDropped (for extension authors).

Cost note

Projects with a rules file make one rules request for each file written through the shell, capped per command.