pi-verdict
Minimal Pi permission gate: deterministic rules first, then a classifier answers allow, ask or deny per gray-zone tool call; fails closed.
Overview
pi-verdict is a minimal permission gate for Pi, inspired by Claude Code's auto mode, that checks every tool call before it runs. Built-in danger rules and user allow/deny rules settle clear cases first at zero latency; everything else goes to a model classifier that sees conversation context and returns one of three states: allow, ask or deny. Ask routes genuinely ambiguous actions to a human and degrades to deny in non-interactive sessions. Any uncertainty or failure fails closed.
Since version 0.13 the classifier rides Pi's native classify(), and per the list summary Jev is an optional, experimental backend reachable through OpenRouter or TypeSafe's direct API. Design principles include a deterministic floor never overridden by the classifier, judging what an action does rather than its syntax, minimal trusted input (no tool results or path plaintext sent), realpath-aware path identity, and self-protection that no configuration can disable. It is about 2k lines in a single core file and works with Pi and oh-my-pi. Documentation is in English and Chinese.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this tool call be allowed, asked about or denied? | allow · ask · deny |
How it works
- Apply built-in danger and user rules.
- Send gray-zone calls with context to the classifier.
- Allow, ask the human, or deny.
- Deny on errors or timeouts.
Strengths
- Three-state verdict avoids silent unsafe execution.
- Deterministic floor and self-protection.
- Minimal data sent to the classifier.
Caveats
- Jev backend is optional and experimental.
- A permission gate, not a sandbox.
Getting started
pi install npm:pi-verdict (or omp plugin install npm:pi-verdict).At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi / oh-my-pi extension
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
Agent safety: Pi permission gate where Jev answers one Choice (allow/ask/deny) per gray-zone tool call — deterministic rules settle clear cases first, deny blocks, ask escalates to a human confirm, and errors or timeouts deny; Jev is an optional backend, experimental, reached through OpenRouter or TypeSafe's direct API.
yibie/awesome-jev
Frequently asked questions
What does ask do in headless runs?
It degrades to deny.
Is Jev required?
No, it is an optional experimental backend.
Can the classifier override hard denies?
No, the deterministic floor always wins.
Related projects
Local guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptPre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptClaude Code plugin adding Jev judgments to Bash, Write and Edit calls and their outputs; a semantic guardrail, not a sandbox.
PluginbetaAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScript