pi-jev-auto-mode
Auto mode for Pi: deterministic policy first, then Jev judges escalated bash/write/edit calls, failing closed when undecidable.
Overview
pi-jev-auto-mode adds an auto mode to the Pi coding agent, which has no built-in permission system. It judges bash, write and edit calls in two layers. A deterministic layer handles hard-deny commands (never sent to Jev), user deny and allow patterns, safe commands, dangerous-command detection, protected paths, read-only builtins and in-project writes. Everything else, by default under gateScope all, goes to Jev, which returns allow, block or block-if-undecidable; the gate fails closed when a decision cannot be made.
To keep auto mode useful, the intent question is asked only about commands recognised as dangerous shapes, and only a clear 'this was not requested' blocks. The README notes that pattern-only gating missed a curl upload of an SSH key, motivating the all scope, and measures judged calls at roughly 193-642 ms. Milestones 1-3 are complete with deterministic envelope, Jev engine, real-API calibration, per-rule thresholds and decision records, and 171 offline tests.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this escalated tool call be allowed? | allow · block · block-if-undecidable |
| Yes / no | Was this dangerous-looking command requested by the user? | yes · no |
How it works
- Apply deterministic policy (hard-deny, patterns, fast paths).
- Escalate remaining calls to Jev.
- Allow, block, or block when undecidable.
- Record decisions for calibration.
Strengths
- Fails closed when uncertain.
- Fast paths keep ordinary work quick.
- Calibrated thresholds from real API runs.
Caveats
- Judged calls add about half a second.
- Requires a TypeSafe key.
Getting started
Install the extension into Pi, set your TypeSafe key, and use /jev-auto-mode scope all|matched to choose reach.At a glance
- Type
- Project
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi extension
- Has code
- yes
- Has tests
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Pi auto mode: Jev semantically approves `bash` / `write` / `edit`, and fails closed when it cannot decide.
AnotiaWang/awesome-decision-modelsAdds rule checks to Pi commands and file operations, then uses Jev to assess cases that need further judgment.
logicrw/awesome-jev-projectsJev (TypeSafe System One) backed auto mode for the Pi coding agent…
wh000wh000/awesome-jev-liveJev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.
hellogumbo/awesome-jev
Frequently asked questions
What if Jev cannot decide?
The call is blocked; the gate fails closed.
Are hard-deny commands sent to Jev?
No, they are blocked by the deterministic layer.
How slow is a judged call?
Measured 193-642 ms across eleven ordinary commands.
Related projects
OpenAI-compatible endpoint that answers an agent's command-approval call with APPROVE, DENY or ESCALATE from a Jev Choice, failing closed.
ProxybetaPythonLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptOMP plugin that sends unreviewed bash commands to Jev and turns UNSAFE or UNSURE verdicts into Run-or-Deny prompts.
ProjectbetaTypeScriptPi extension that turns what you say into structured runtime constraints and checks every side-effecting tool call against them.
PluginbetaTypeScriptPi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
PluginbetaTypeScript