pi-warden

How we reviewed this: pi-warden is an extension for the Pi coding agent, and running Pi needs a model key we don’t use. We ran the project’s own test suite, called its guards directly with no key (the offline mode), tested its redaction on sample secrets, and ran its live action-guard cases against the real Jev API. We tested commit d015953.

What it does

pi-warden supervises Pi while it works. Before a bash, write, or edit call runs, it decides whether to allow it, warn, or hold it. It usually steers the agent with a message explaining what’s wrong rather than interrupting you. Its guards cover:

• Actions: irreversible or off-task commands and edits, judged against what you asked for.
• Rules: every write checked against the headings of a pi-warden.md file in your project, with the broken rule quoted back.
• Slop, stuck loops, and done claims: stubs and restating comments, repeated failed attempts, and “done” with no test or build behind it.
• Security, runaway replies, and large outputs: hardcoded secrets, replies that start repeating, and oversized tool output it compresses but keeps retrievable.

Without a key, it still runs an offline layer: known-dangerous command patterns, sensitive-path notes, and a runaway stop. Jev adds the judgment calls. It can also use OpenRouter as the backend. The README reports results from the project’s own A/B runs, with the reports and tooling in the repository.

Setup

pi install npm:pi-warden

Then /warden enable inside Pi. It asks for consent before anything leaves your machine and optionally takes a TypeSafe key. /warden test shows a sample verdict. It needs Pi 0.85+ and Node 22.19+.

Using it

• The tests pass, with one catch. All 315 tests passed once ~/.pi/agent/pi-warden/ existed. On a fresh machine without that directory, 16 failed. The local database can’t be created without the folder, so the code falls back to a stand-in object, and that object lacks a method the hold recorder calls. The same fallback is what runs on Node builds without node:sqlite, which a commit earlier that day was meant to support. Our fix was merged the same day.
• The offline safety net works. With no key, git push --force, git reset --hard, DROP TABLE, piping a downloaded script to sh, and chmod -R 777 were all held for confirmation, rm -rf and touching .env produced warnings, and git status and npm test passed straight through.
• The Jev path works end to end. The project’s live action cases, such as running tests on task, a hard reset nobody asked for, and an unrelated write, each returned a verdict with its reasons. As always, we don’t publish how Jev judged them.
• The documentation is exceptional. There’s a guide per guard with its thresholds and questions, a configuration reference, an FAQ, and a data-handling page that lists every field each guard sends and how many characters of it.

Permissions and data

• Nothing is sent before you consent. After that, each judged action sends your latest prompt, up to eight earlier messages, the agent’s stated plan, and the command or a sample of the file change, all truncated. Read-only commands such as ls and git status send nothing.
• Redaction is good, but has gaps. It removed Authorization headers, TOKEN=-style assignments, OpenAI-, GitHub-, Stripe-, and AWS-style keys, JWTs, and a private key block. It did not redact the password in postgres://admin:secret@db:5432/app: its URL rule only covers http and https, although the data-handling page says URL passwords are redacted. A quoted passphrase with spaces was only partly removed. The project calls redaction best-effort, and that’s the right way to treat it. The maintainer merged our fix for both within the hour; it isn’t in an npm release yet (0.28.4 is the latest).
• It keeps local records. A hold log (tool, pattern IDs, scores, and outcome, but not commands or prompts) and full copies of compressed output in the temp directory, both owner-only per the docs, plus a learning database. The key is stored owner-only too, unless you use the environment variable.

Maintenance

Ninety-one commits between September 16 and 19, with versions up to 0.29.0 on GitHub and 0.28.4 on npm, a changelog, issue templates, and contributions from two other developers. It’s MIT licensed with no open issues, but there’s no CI to catch problems like the fallback bug above.

Verdict

pi-warden is an unusually complete agent guardrail, and its documentation sets a high bar for honesty about data. If you use Pi, the offline layer alone is worth installing, and the Jev-backed guards add rule checks that no linter can do. Before enabling Jev, know what each judged action sends, and don’t rely on redaction for database connection strings until the fix reaches npm. For a similar idea built for Claude Code, see jev-gates. For checking a finished diff instead, see Jev Review.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 19, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.