DevMortimer/pi-warden

Review signals: 1 hardcoded secret, 3 known vulnerability, 1 outside write. 58 static matches retained as context.

Reviewed as expected for a test run: npm built the package inside its global install folder.

Gitleaks found a possible hardcoded secret; value withheld. scripts/rules-cases.mjs

OSV reports a known vulnerability in this dependency version. brace-expansion 3 findings.

Repository processes attempted these writes outside documented output/cache paths. 4 distinct locations. 201 attributed processes.

2 download and execute matches retained as context; full list in the evidence.

52 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Each # heading in pi-warden.md is one rule that the rules guard judges: Real input produced the expected result: Rules in force: pi-warden.md (12 rules, 0 dropped)

  Source: Each `#` heading is one rule.

  Input: demo project with examples/pi-warden.md copied to pi-warden.md (12 headings)

  Expected: the rules listing reports 12 rules

  Command: pi --no-extensions -e <guest-path> --mode rpc --no-session --offline

  Observed: Rules in force: pi-warden.md (12 rules, 0 dropped)\n1. no-console-output-in-library-code paths: src/**\n2. todo-comments-need-a-reference paths: (all)\n3. no-explicit-any paths: **/*.ts, **/*.tsx\n4. exported-functions-declare-their-return-type paths: src/**/*.ts\n5. errors-are-not-swallowed paths: (all)\n6. switch-statements-have-a-default-case paths: (all)\n7. no-hardcoded-secrets paths: (all)\n8. boolean-names-read-as-a-question paths: (all)\n9. new-exported-functions-get-a-test paths: src/**\n10. comments-explain-why-not-what paths: (all)\n11. no-commented-out-code paths: (all)\n12. migrat

• Destructive patterns are held with no key and no request: Real input produced the expected result: patterns: rm-recursive-dangerous-target

  Source: Holds destructive patterns (force push, `reset --hard`, `rm -rf` on a path outside scratch, `DROP`) with no key and no request

  Input: /warden test with no TypeSafe key (synthetic rm -rf demo)

  Expected: the offline pattern check flags rm-recursive-dangerous-target

  Command: pi --no-extensions -e <guest-path> --mode rpc --no-session --offline

  Observed: patterns: rm-recursive-dangerous-target · confirm — destructive: recursive rm on an absolute, home, variable, or parent path (pattern checks only: TypeSafe judgments are not enabled or no key is configured)","notifyType":"info"} {"type":"extension_ui_request","id":"ad09dd56-ebd9-4d52-8d13-51b511d4eb09","method":"notify","message":"In steer mode a real call would be held and the agent would read: \"pi-warden held this bash call before it ran: destructive: recursive rm on an absolute, home, variable, or parent path. Do not retry it unchanged. Either (1) reach the goal with a recoverable alternat

Examples

• Copy pi-warden.md to the project root and /warden rules lists its rules: command completed successfully

  Source: examples/README.md

  Input: examples/pi-warden.md copied to <guest-path>, then /warden rules over RPC

  Expected: 12 rules listed from pi-warden.md

  Command: pi --no-extensions -e <guest-path> --mode rpc --no-session --offline

  Observed: reference paths: (all)\n3. no-explicit-any paths: **/*.ts, **/*.tsx\n4. exported-functions-declare-their-return-type paths: src/**/*.ts\n5. errors-are-not-swallowed paths: (all)\n6. switch-statements-have-a-default-case paths: (all)\n7. no-hardcoded-secrets paths: (all)\n8. boolean-names-read-as-a-question paths: (all)\n9. new-exported-functions-get-a-test paths: src/**\n10. comments-explain-why-not-what paths: (all)\n11. no-commented-out-code paths: (all)\n12. migrations-are-reversible paths: **/migrations/**","notifyType":"info"} {"id":"1","type":"response","command":"prompt","success":true}

• Type-check the TypeScript sources: command completed successfully

  Source: README.md

  Input: npm run typecheck (Development section)

  Expected: tsc exits 0

  Command: npm run typecheck

  Observed: > [email protected] typecheck > tsc --noEmit

• Run the offline test suite: Deferred from the replay on purpose: full run is about 13 minutes and has timing-dependent tests that fail intermittently (1 to 24 failures across runs, each passing alone). Full result recorded in the report: 1735 of 1736 on the last run with HOME=<host-path> and make installed.

  Source: README.md

  Input: npm test (Development section)

  Expected: offline tests pass

  Observed: Deferred from the replay on purpose: full run is about 13 minutes and has timing-dependent tests that fail intermittently (1 to 24 failures across runs, each passing alone). Full result recorded in the report: 1735 of 1736 on the last run with HOME=<host-path> and make installed.

Local or hosted: local

Run pi-warden (pinned commit f22c151) inside the Pi agent over RPC: /warden rules lists the rules from pi-warden.md, and /warden test runs the offline destructive-command check with no TypeSafe key.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -200
cd <guest-path> && git status 2>&1 | head -3; ls -la <guest-path> ; ls /inputs 2>&1
cd <guest-path> && which node npm git uv 2>&1; node --version 2>&1; npm --version 2>&1; git --version; sed -n 1,200p package.json; ls -la .coldpass; ls <guest-path>
cd <guest-path> && git init -q && git remote add origin https://github.com/DevMortimer/pi-warden && (git fetch --depth 1 origin f22c15187766e8cd9bfa164625c8225f21e39e77 2>&1 | tail -5) && git reset --mixed FETCH_HEAD 2>&1 | tail -3 && git log --oneline -1 && git status --short | head -20; sudo -n true && echo SUDO_OK; cat /etc/os-release | head -2
export NODE_USE_ENV_PROXY=1; (curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - ) 2>&1 | tail -5; sudo apt-get install -y nodejs 2>&1 | tail -3; node --version; npm --version
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -15; echo "EXIT=$?"
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm run check 2>&1 | tail -40; echo "EXIT=${PIPESTATUS[0]}"
mkdir -p <guest-path> && cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm run typecheck ><guest-path> 2>&1; echo TYPECHECK=$?; npm run build ><guest-path> 2>&1; echo BUILD=$?; ls dist | head; timeout 1500 npm test > <guest-path> 2>&1; echo TEST=$?; grep -n "^not ok\|^    not ok\|^  not ok" <guest-path> | head -40
cd <guest-path> && sed -n 4750,4775p test.log; echo ----; sed -n 6183,6200p test.log; echo ----; sed -n 6262,6290p test.log; echo ----; sed -n 9908,9925p test.log; echo ---; sed -n 10174,10190p test.log
cd <guest-path> && echo HOME=$HOME TMPDIR=$TMPDIR USER=$USER; cat tests/setup-env.ts | head -40; echo ----; grep -n "HOME\|homedir\|tmpdir" src/*.ts | head -30; echo; bash --version | head -1; ls -l /bin/sh
cd <guest-path> && PWHOME=$(getent passwd $(id -u) | cut -d: -f6); echo PWHOME=$PWHOME; ls -ld "$PWHOME" 2>&1; export NODE_USE_ENV_PROXY=1; HOME="$PWHOME" timeout 1500 npm test > <guest-path> 2>&1; echo TEST=$?; grep -n "^# pass\|^# fail" <guest-path>; grep -n "^not ok" <guest-path> | head -30
cd <guest-path> && sed -n 5694,5712p test2.log; echo ----; sed -n 7769,7800p test2.log
cd <guest-path> && which make; make --version 2>&1 | head -1; export NODE_USE_ENV_PROXY=1; HOME=<host-path> node --import tsx --import ./tests/setup-env.ts --test tests/judge-input.test.ts 2>&1 | grep -E "^# (pass|fail)|^not ok" ; HOME=<host-path> node --import tsx --import ./tests/setup-env.ts --test tests/extension.test.ts 2>&1 | grep -E "^# (pass|fail)|^not ok"; grep -n "indented make" tests/judge-input.test.ts | head
cd <guest-path> && sudo apt-get install -y make ><guest-path> 2>&1; echo APT=$?; make --version | head -1; export NODE_USE_ENV_PROXY=1; HOME=<host-path> timeout 1500 npm test > <guest-path> 2>&1; echo TEST=$?; grep -E "^# (tests|pass|fail)" <guest-path>; grep -n "^not ok" <guest-path> | head
cd <guest-path> && sed -n 5391,5405p test3.log; cd <guest-path> && export NODE_USE_ENV_PROXY=1; for i in 1 2; do HOME=<host-path> node --import tsx --import ./tests/setup-env.ts --test tests/extension.test.ts 2>&1 | grep -E "^# (pass|fail)|^not ok"; done
cd <guest-path> && ls docs examples scripts extensions; echo ----; sed -n 1,80p docs/commands.md; echo ----; cat scripts/dev-pi.mjs | head -60; ls node_modules/.bin | grep -i "^pi" 
cd <guest-path> && ./node_modules/.bin/pi --version 2>&1 | tail -2; ./node_modules/.bin/pi --help 2>&1 | head -60
export NODE_USE_ENV_PROXY=1; (sudo npm install -g @earendil-works/[email protected] 2>&1 | tail -3); echo NPMG=$?; which pi && pi --version; npm view pi-warden version 2>&1 | tail -2
export NODE_USE_ENV_PROXY=1; cd /tmp && timeout 600 pi install npm:pi-warden 2>&1 | tail -15; echo INSTALL=$?; pi list 2>&1 | tail -5
mkdir -p <guest-path> && cd <guest-path> && timeout 120 pi -p --no-session --offline "/warden status" 2>&1 | head -40; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cp <guest-path> ./pi-warden.md && (printf '%s\n' '{"id":"1","type":"prompt","message":"/warden rules"}' ; sleep 20) | timeout 60 pi --mode rpc --no-session --offline 2>&1 | head -c 3000; echo; echo EXIT=${PIPESTATUS[1]}
cd <guest-path> && printf '%s\n' '{"id":"1","type":"prompt","message":"/warden rules"}' > <guest-path> && timeout 60 pi --no-extensions -e <guest-path> --mode rpc --no-session --offline < <guest-path> > <guest-path> 2><guest-path>; echo EXIT=$?; grep -o 'Rules in force[^"]*' <guest-path> | head -c 400; echo; cat <guest-path> | head -5; grep -c . <guest-path>
cd <guest-path> && printf '%s\n' '{"id":"1","type":"prompt","message":"/warden test"}' > <guest-path> && timeout 90 pi --no-extensions -e <guest-path> --mode rpc --no-session --offline < <guest-path> > <guest-path> 2><guest-path>; echo EXIT=$?; grep -o '"message\\\?":"[^}]*' <guest-path> | head -c 1500; echo; head -c 400 <guest-path>
cd <guest-path> && sed -n 1,40p examples/README.md; echo ----; grep -n -i "cron\|--once\|--now\|webhook\|setInterval\|schedule" README.md docs/*.md | head; echo ----; grep -n "setInterval\|setTimeout\|cron" src/*.ts extensions/index.js | head -20; echo ----; grep -c "^# " examples/pi-warden.md
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["pi","--no-extensions","-e","<guest-path>","--mode","rpc","--no-session","--offline"],"cwd":"<guest-path>","stdin":"{\"id\":\"1\",\"type\":\"prompt\",\"message\":\"/warden rules\"}\n","expected_text":"Rules in force: pi-warden.md (12 rules, 0 dropped)"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"Each # heading in pi-warden.md is one rule that the rules guard judges","source":"Each `#` heading is one rule.","input":"demo project with examples/pi-warden.md copied to pi-warden.md (12 headings)","expected":"the rules listing reports 12 rules","probe_kind":"cli","argv":["pi","--no-extensions","-e","<guest-path>","--mode","rpc","--no-session","--offline"],"stdin":"{\"id\":\"1\",\"type\":\"prompt\",\"message\":\"/warden rules\"}\n","expected_text":"Rules in force: pi-warden.md (12 rules, 0 dropped)","cwd":"<guest-path>"},
{"kind":"claim","claim":"Destructive patterns are held with no key and no request","source":"Holds destructive patterns (force push, `reset --hard`, `rm -rf` on a path outside scratch, `DROP`) with no key and no request","input":"/warden test with no TypeSafe key (synthetic rm -rf demo)","expected":"the offline pattern check flags rm-recursive-dangerous-target","probe_kind":"cli","argv":["pi","--no-extensions","-e","<guest-path>","--mode","rpc","--no-session","--offline"],"stdin":"{\"id\":\"1\",\"type\":\"prompt\",\"message\":\"/warden test\"}\n","expected_text":"patterns: rm-recursive-dangerous-target","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Copy pi-warden.md to the project root and /warden rules lists its rules","source":"examples/README.md","input":"examples/pi-warden.md copied to <guest-path>, then /warden rules over RPC","expected":"12 rules listed from pi-warden.md","argv":["pi","--no-extensions","-e","<guest-path>","--mode","rpc","--no-session","--offline"],"cwd":"<guest-path>","stdin":"{\"id\":\"1\",\"type\":\"prompt\",\"message\":\"/warden rules\"}\n","expected_text":"Rules in force: pi-warden.md (12 rules"},
{"kind":"example","claim":"Type-check the TypeScript sources","source":"README.md","input":"npm run typecheck (Development section)","expected":"tsc exits 0","argv":["npm","run","typecheck"],"cwd":"<guest-path>","expected_text":"> [email protected] typecheck"},
{"kind":"example","claim":"Run the offline test suite","source":"README.md","input":"npm test (Development section)","expected":"offline tests pass","deferred":true,"reason":"Deferred from the replay on purpose: full run is about 13 minutes and has timing-dependent tests that fail intermittently (1 to 24 failures across runs, each passing alone). Full result recorded in the report: 1735 of 1736 on the last run with HOME=<host-path> and make installed."}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: extensions/index.js, src/extension.ts and the README/docs. pi-warden runs per Pi event (tool calls, prompts, turn ends) and has no cron, scheduler, --once/--now, loop or webhook trigger. The only setTimeout/setInterval uses are per-call timeouts and throttles, so there is no product cycle to trigger by hand.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Run pi-warden (pinned commit f22c151) inside the Pi agent over RPC: /warden rules lists the rules from pi-warden.md, and /warden test runs the offline destructive-command check with no TypeSafe key.",
  "operation_scope": "Offline only. Needs Node >=22.19.0 (installed 22.23.4), the Pi CLI 0.87.0, and the checkout built with npm install and npm run build. No TypeSafe key, no browser, no Jev judgments. The Jev-judged rules guard, /warden enable, and the agent-driven commands (/warden improve, /warden audit) were not exercised.",
  "steps": [
    "git init; git remote add origin https://github.com/DevMortimer/pi-warden; git fetch --depth 1 origin f22c15187766e8cd9bfa164625c8225f21e39e77; git reset --mixed FETCH_HEAD",
    "curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -; sudo apt-get install -y nodejs (Node v22.23.4, npm 10.9.9)",
    "npm install (README Development section)",
    "npm run typecheck (exit 0)",
    "npm run build (exit 0, writes dist/)",
    "npm test (README Development section; see deviations for the environment fixes)",
    "sudo npm install -g @earendil-works/[email protected] (Pi CLI, devDependency version)",
    "pi install npm:pi-warden (README Install section; installed the published npm package)",
    "pi --no-extensions -e <guest-path> --mode rpc --no-session --offline, stdin JSON prompt '/warden rules' (returns 'Rules in force: pi-warden.md (12 rules, 0 dropped)')",
    "same command with stdin prompt '/warden test' (returns 'patterns: rm-recursive-dangerous-target', held in steer mode)"
  ],
  "deviations": [
    "Node was not installed in the guest (the README does not name it; package.json requires node >=22.19.0). Installed Node 22 via the NodeSource setup_22.x script, which is curl|sh with sudo, and apt. Ubuntu 24.04's default node is too old.",
    "The pi CLI was not on PATH. Installed it with sudo npm install -g @earendil-works/[email protected], matching the devDependency.",
    "First npm test: 24 failures. Cause is the guest, not the product: HOME was <guest-path>, which is under the temp root /tmp, so guard tests for ~/Library and $HOME/projects were treated as scratch and not held. Reran with HOME=<host-path> (passwd home): 2 failures.",
    "One failure was test 1110 (judge-input), which needs the make command. make was missing; installed it with sudo apt-get install -y make.",
    "Remaining full-suite failures vary between runs (1 to 2 per run, e.g. tests 720 and 770). Each passes when its file runs alone (extension.test.ts 299/299 on two reruns). These look like timing-dependent tests under load. The last full run was 1735 of 1736 passing. npm run check was not re-run as one command after the fixes; typecheck and build were run separately and both exited 0.",
    "pi -p (print mode) returned nothing for /warden commands. The working route was --mode rpc with JSON prompts on stdin. The README documents these commands inside the Pi TUI, not RPC, so the RPC invocation is my substitute.",
    "pi install npm:pi-warden installed the published npm package, not the pinned checkout. The probes and claims load the pinned checkout with --no-extensions -e <guest-path> The npm registry reported the latest published version as 1.14.0, while the pinned package.json says 2.0.0; I did not investigate this further.",
    "The README's /warden enable and Jev-judged features need a TypeSafe key, which I did not have, so they were not run. The inline node -e snippet in examples/README.md was not run (inline code is not a probe).",
    "No browser was used and no servers were started, so none needed stopping."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "None needed for the product. For the repo: the test suite should not depend on HOME sitting under /tmp, should document make as a prerequisite, and should fix the timing-dependent tests that fail intermittently under load."
}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo REPORT_OK; ps aux | grep -E "pi |pi-warden" | grep -v grep | head -3; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo EXIT=$?; python3 -I -c "import json;d=json.load(open('<guest-path>'));print(d['valid'],d['problems'],d['replay']['status'])" 2>&1 | tail -2; pgrep -fa "rpc|pi-warden" | grep -v pgrep | head -3; echo servers_checked