@jwilger/pi-development-system 0.2.0 → 0.3.0

package/extensions/development-system.ts

@@ -7,6 +7,8 @@ import { createApprovalStore } from "../src/gates/approvals.ts";
 import { registerGitGuard } from "../src/gates/git-guard.ts";
 import { createRecordDepartureTool } from "../src/gates/record-departure-tool.ts";
 import { createRequestApprovalTool } from "../src/gates/request-approval-tool.ts";
+import { registerTestGuard } from "../src/gates/test-guard.ts";
+import { createJevHolder } from "../src/jev/holder.ts";
 import { createSessionState } from "../src/state/session-state.ts";
 
 const nonNegotiables = readFileSync(
@@ -19,14 +21,19 @@ export function createDevelopmentSystem(pi: ExtensionAPI) {
   const state = createSessionState(pi);
   const approvals = createApprovalStore(pi);
 
+  const jevHolder = createJevHolder();
+  let jevModel: string | undefined;
   let lastCtx: ExtensionContext | undefined;
 
   const refreshStatus = () => {
-    lastCtx?.ui.setStatus(STATUS_KEY, renderStatusLine(state.get()));
+    lastCtx?.ui.setStatus(STATUS_KEY, renderStatusLine(state.get(), jevModel));
   };
 
   const rebuild = (ctx: ExtensionContext) => {
     lastCtx = ctx;
+    const probe = jevHolder.probe(ctx);
+    jevModel = probe.model;
+    state.update((s) => (s.jev === probe.availability ? s : { ...s, jev: probe.availability }));
     const entries = ctx.sessionManager
       .getBranch()
       .flatMap((e) => (e.type === "custom" ? [{ customType: e.customType, data: e.data }] : []));
@@ -48,14 +55,15 @@ export function createDevelopmentSystem(pi: ExtensionAPI) {
     return messages === undefined ? undefined : { messages };
   });
 
-  registerGitGuard({ pi, approvals });
+  registerGitGuard({ pi, approvals, jev: (ctx) => jevHolder.forContext(ctx) });
+  registerTestGuard({ pi, state, approvals, jev: (ctx) => jevHolder.forContext(ctx) });
   pi.registerTool(createRecordDepartureTool({ pi, state }));
   pi.registerTool(createRequestApprovalTool({ pi, approvals }));
 
   pi.registerCommand("devsys-status", {
     description: "Show development-system phase, sizing, slice, departures and Jev status",
     handler: async (_args, ctx) => {
-      ctx.ui.notify(renderStatus(state.get()), "info");
+      ctx.ui.notify(renderStatus(state.get(), jevModel), "info");
     },
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/src/context/context-tail.ts

@@ -18,7 +18,9 @@ export function renderContextTail(state: DevsysState): string | undefined {
   ];
   const tailLines = [REMINDER];
   const room = MAX_LINES - head.length - tailLines.length - 1;
-  const lines = state.openDepartures.map((d) => `- ${d.gate} — ${d.chosen} (${scopeLabel(d)})`);
+  const lines = state.openDepartures.map(
+    (d) => `- ${d.gate} — ${d.chosen.replace(/\s+/g, " ")} (${scopeLabel(d)})`,
+  );
   const shown =
     lines.length <= room
       ? lines

package/src/context/status.ts

@@ -2,15 +2,18 @@ import type { DevsysState } from "../core/types.ts";
 
 export const STATUS_KEY = "devsys";
 
-export const renderStatusLine = (state: DevsysState): string =>
-  `devsys: ${state.phase} · jev ${state.jev}`;
+const jevLabel = (state: DevsysState, model: string | undefined): string =>
+  state.jev === "online" && model !== undefined ? `online (${model})` : state.jev;
 
-export const renderStatus = (state: DevsysState): string =>
+export const renderStatusLine = (state: DevsysState, jevModel?: string): string =>
+  `devsys: ${state.phase} · jev ${jevLabel(state, jevModel)}`;
+
+export const renderStatus = (state: DevsysState, jevModel?: string): string =>
   [
     "Development system status",
     `- phase: ${state.phase}`,
     `- sizing: ${state.sizing ?? "unset"}`,
     `- active slice: ${state.activeSlice ?? "none"}`,
     `- open departures: ${state.openDepartures.length}`,
-    `- jev: ${state.jev}`,
+    `- jev: ${jevLabel(state, jevModel)}`,
   ].join("\n");

package/src/core/git-intent.ts

@@ -23,15 +23,22 @@ const SEVERITY: ReadonlyArray<GitIntent> = [
 const worst = (a: GitIntent, b: GitIntent): GitIntent =>
   SEVERITY.indexOf(a) <= SEVERITY.indexOf(b) ? a : b;
 
-/** Splits a command string on newlines that are outside quotes. */
+/** Splits a command string on newlines that are outside quotes; backslash-newline is a continuation. */
 function splitLines(command: string): string[] {
   const lines: string[] = [];
   let current = "";
   let quote: "'" | '"' | undefined;
-  for (const ch of command) {
+  for (let i = 0; i < command.length; i++) {
+    const ch = command.charAt(i);
     if (quote !== undefined) {
       if (ch === quote) quote = undefined;
       current += ch;
+    } else if (ch === "\\" && command.charAt(i + 1) === "\n") {
+      i++;
+    } else if (ch === "#" && (current === "" || /\s$/.test(current))) {
+      // A comment runs to the end of the line; quotes inside it do not open a quote.
+      while (i < command.length && command.charAt(i) !== "\n") current += command.charAt(i++);
+      i--;
     } else if (ch === "'" || ch === '"') {
       quote = ch;
       current += ch;
@@ -46,18 +53,34 @@ function splitLines(command: string): string[] {
   return lines;
 }
 
+const isRedirect = (op: string): boolean => /^[<>]/.test(op) && !op.endsWith("(");
+
 /** Tokens of one line grouped into simple commands (operators separate segments). */
 function segments(line: string): string[][] {
   const result: string[][] = [[]];
   for (const token of parse(line, (name) => `$${name}`)) {
     if (typeof token === "string") result[result.length - 1]?.push(token);
     else if ("pattern" in token) result[result.length - 1]?.push(token.pattern);
+    else if ("op" in token && isRedirect(token.op)) continue;
     else if (!("comment" in token)) result.push([]);
   }
   return result.filter((s) => s.length > 0);
 }
 
 const WRAPPERS = new Set(["command", "sudo", "env", "time", "nohup", "exec", "builtin", "nice"]);
+const KEYWORDS = new Set(["then", "do", "else", "elif", "if", "while", "until", "{", "!", "time"]);
+const DATA_ONLY = new Set([
+  "echo",
+  "printf",
+  "cat",
+  "grep",
+  "rg",
+  "man",
+  "which",
+  "type",
+  "head",
+  "tail",
+]);
 const SHELLS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
 const OPAQUE = new Set(["xargs", "ssh", "find", "parallel", "watch"]);
 const GLOBAL_WITH_VALUE = new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace"]);
@@ -66,22 +89,30 @@ const HOOK_SKIP_ENV = new Set(["LEFTHOOK=0", "HUSKY=0"]);
 const basename = (path: string): string => path.slice(path.lastIndexOf("/") + 1);
 const isAssignment = (t: string): boolean => /^[A-Za-z_][A-Za-z0-9_]*=/.test(t);
 
+/** True when `arg` is `name` or an unambiguous-looking git abbreviation of it (`--amen`, `--del=x`). */
+const isLong = (arg: string, ...names: string[]): boolean => {
+  const key = arg.split("=")[0] ?? "";
+  return key.length >= 4 && key.startsWith("--") && names.some((n) => n.startsWith(key));
+};
+
 function classifyGitArgs(globals: string[], sub: string | undefined, args: string[]): GitIntent {
   let intent: GitIntent = "ordinary";
-  if (globals.some((g) => /^core\.hooksPath=/.test(g))) intent = worst(intent, "no-verify");
-  if (args.includes("--no-verify")) intent = worst(intent, "no-verify");
+  if (globals.some((g) => /^core\.hookspath=/i.test(g))) intent = worst(intent, "no-verify");
+  if (args.some((a) => isLong(a, "--no-verify"))) intent = worst(intent, "no-verify");
   switch (sub) {
     case "push": {
       const shortFlags = args.filter((a) => /^-[A-Za-z]+$/.test(a));
       if (
-        args.some((a) => /^--(force|force-with-lease|force-if-includes|mirror)\b/.test(a)) ||
+        args.some((a) =>
+          isLong(a, "--force", "--force-with-lease", "--force-if-includes", "--mirror"),
+        ) ||
         shortFlags.some((a) => a.includes("f")) ||
         args.some((a) => /^\+\S/.test(a))
       ) {
         return worst(intent, "force-push");
       }
       if (
-        args.includes("--delete") ||
+        args.some((a) => isLong(a, "--delete")) ||
         shortFlags.includes("-d") ||
         args.some((a) => /^:\S/.test(a))
       ) {
@@ -90,7 +121,7 @@ function classifyGitArgs(globals: string[], sub: string | undefined, args: strin
       return intent;
     }
     case "commit":
-      if (args.includes("--amend")) return worst(intent, "history-rewrite");
+      if (args.some((a) => isLong(a, "--amend"))) return worst(intent, "history-rewrite");
       if (args.some((a) => /^-[A-Za-z]*n[A-Za-z]*$/.test(a))) return worst(intent, "no-verify");
       return intent;
     case "rebase":
@@ -101,7 +132,7 @@ function classifyGitArgs(globals: string[], sub: string | undefined, args: strin
     case "filter-repo":
       return worst(intent, "history-rewrite");
     case "reset":
-      return args.includes("--hard") ? worst(intent, "destructive-reset") : intent;
+      return args.some((a) => isLong(a, "--hard")) ? worst(intent, "destructive-reset") : intent;
     default:
       return intent;
   }
@@ -116,7 +147,7 @@ function classifySegment(tokens: string[]): GitIntent {
     if (isAssignment(t)) {
       if (HOOK_SKIP_ENV.has(t)) hookSkip = true;
       i++;
-    } else if (WRAPPERS.has(t)) {
+    } else if (WRAPPERS.has(t) || KEYWORDS.has(t)) {
       i++;
     } else {
       break;
@@ -129,13 +160,18 @@ function classifySegment(tokens: string[]): GitIntent {
     hookSkip ? worst(intent, "no-verify") : intent;
   if (head.startsWith("$") || base === "$GIT") return "unknown";
   if (SHELLS.has(base)) {
-    const c = rest.indexOf("-c");
+    const c = rest.findIndex((t) => /^-[A-Za-z]*c[A-Za-z]*$/.test(t));
     const script = c >= 0 ? rest[c + 1] : undefined;
     return script !== undefined ? classifyGitCommand(script) : "ordinary";
   }
   if (base === "eval") return classifyGitCommand(rest.join(" "));
   if (OPAQUE.has(base)) return rest.some((t) => basename(t) === "git") ? "unknown" : "ordinary";
-  if (base !== "git") return "ordinary";
+  if (base !== "git") {
+    if (DATA_ONLY.has(base)) return "ordinary";
+    // Wrapper with options (`sudo -E git ...`, `timeout 5 git ...`): classify from the git token.
+    const at = rest.findIndex((t) => basename(t) === "git");
+    return at >= 0 ? withHookSkip(classifySegment(rest.slice(at))) : "ordinary";
+  }
   const globals: string[] = [];
   let j = 0;
   while (j < rest.length && (rest[j] ?? "").startsWith("-")) {
@@ -148,14 +184,92 @@ function classifySegment(tokens: string[]): GitIntent {
     }
   }
   const sub = rest[j];
-  return withHookSkip(classifyGitArgs(globals, sub, rest.slice(j + 1)));
+  const args = rest.slice(j + 1);
+  const dynamic =
+    (sub ?? "").startsWith("$") ||
+    (["push", "reset", "rebase"].includes(sub ?? "") &&
+      args.some((t) => t.startsWith("$") || t.includes("`")));
+  const intent = classifyGitArgs(globals, sub, args);
+  return withHookSkip(dynamic ? worst(intent, "unknown") : intent);
+}
+
+/**
+ * The parts of a line bash may still execute or treat as syntax: single-quoted text and
+ * backslash-escaped characters are dropped; double-quoted text is kept unless `dropDouble`.
+ */
+function live(line: string, dropDouble: boolean): string {
+  let out = "";
+  let quote: "'" | '"' | undefined;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = undefined;
+    } else if (ch === "\\") {
+      i++;
+    } else if (quote === '"') {
+      if (ch === '"') quote = undefined;
+      else if (!dropDouble) out += ch;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+    } else {
+      out += ch;
+    }
+  }
+  return out;
+}
+
+/** Bodies of `$(...)` and backtick substitutions anywhere in the text (quoted or not). */
+function substitutions(text: string): string[] {
+  const bodies: string[] = [];
+  for (let at = text.indexOf("$("); at >= 0; at = text.indexOf("$(", at + 2)) {
+    let depth = 1;
+    let end = at + 2;
+    for (; end < text.length && depth > 0; end++) {
+      const ch = text.charAt(end);
+      if (ch === "(") depth++;
+      else if (ch === ")") depth--;
+    }
+    bodies.push(text.slice(at + 2, depth === 0 ? end - 1 : end));
+  }
+  for (const m of text.matchAll(/`([^`]*)`/g)) bodies.push(m[1] ?? "");
+  return bodies;
+}
+
+const HEREDOC = /^<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/;
+
+/** The delimiter of a heredoc started by an unquoted `<<` on this line, if any. */
+function heredocDelimiter(line: string): string | undefined {
+  let quote: "'" | '"' | undefined;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined;
+    } else if (ch === "\\") {
+      i++;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+    } else if (line.startsWith("<<<", i)) {
+      i += 2;
+    } else if (ch === "<" && line.charAt(i + 1) === "<") {
+      return HEREDOC.exec(line.slice(i))?.[2];
+    }
+  }
+  return undefined;
 }
 
 /** Classifies the most severe git intent in a shell command (deterministic fast path). */
 export function classifyGitCommand(command: string): GitIntent {
   let intent: GitIntent = "ordinary";
+  let heredocEnd: string | undefined;
   for (const line of splitLines(command)) {
+    if (heredocEnd !== undefined) {
+      if (line.trim() === heredocEnd) heredocEnd = undefined;
+      continue;
+    }
     for (const segment of segments(line)) intent = worst(intent, classifySegment(segment));
+    for (const body of substitutions(live(line, false)))
+      intent = worst(intent, classifyGitCommand(body));
+    heredocEnd = heredocDelimiter(line) ?? heredocEnd;
   }
   return intent;
 }

package/src/core/redact.ts

@@ -0,0 +1,10 @@
+/** Removes credentials from text before it is written to committed logs or session entries (R11). */
+export function redactSecrets(text: string): string {
+  return text
+    .replace(/(\w+:\/\/)[^\s/@]+@/g, "$1[redacted]@")
+    .replace(/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{16,}/g, "[redacted]")
+    .replace(/\b(\w*(?:TOKEN|KEY|SECRET|PASSWORD)\w*)=("[^"]*"|'[^']*'|\S+)/gi, "$1=[redacted]")
+    .replace(/\b(Authorization:\s*)\w+\s+[^\s'"]+/gi, "$1[redacted]")
+    .replace(/\bBearer\s+[^\s'"]+/g, "Bearer [redacted]")
+    .replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "[redacted]");
+}

package/src/core/result.ts

@@ -0,0 +1,7 @@
+/** A value or a typed error (errors as values, R2/R3). */
+export type Result<T, E> =
+  | { readonly ok: true; readonly value: T }
+  | { readonly ok: false; readonly error: E };
+
+export const ok = <T>(value: T): Result<T, never> => ({ ok: true, value });
+export const err = <E>(error: E): Result<never, E> => ({ ok: false, error });

package/src/core/test-paths.ts

@@ -0,0 +1,27 @@
+export type TestPathProfile = { readonly testGlobs?: readonly string[] };
+
+const PATTERNS: readonly RegExp[] = [
+  /(^|\/)(test|tests|__tests__|spec|specs|e2e)\//,
+  /\.(test|spec|cy)\.[cm]?[jt]sx?$/,
+  /_test\.(go|rb|py|exs?|rs)$/,
+  /(^|\/)test_[^/]+\.py$/,
+  /_spec\.rb$/,
+];
+
+const SPECIALS = /[.+^$(){}|[\]\\]/g;
+
+function globToRegExp(glob: string): RegExp {
+  const escaped = glob
+    .replace(SPECIALS, "\\$&")
+    .replace(/\*\*/g, "@@GLOBSTAR@@")
+    .replace(/\*/g, "[^/]*")
+    .replace(/@@GLOBSTAR@@/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+
+/** Whether a repo-relative path is a test file (conventions, plus profile-supplied globs). */
+export function isTestPath(path: string, profile?: TestPathProfile): boolean {
+  const normalized = path.replace(/^\.\//, "");
+  if (PATTERNS.some((p) => p.test(normalized))) return true;
+  return (profile?.testGlobs ?? []).some((g) => globToRegExp(g).test(normalized));
+}

package/src/core/test-weakening.ts

@@ -0,0 +1,68 @@
+import { parse } from "shell-quote";
+
+export type WeakeningSignals = { addsSkip: boolean; emptied: boolean };
+
+const SKIP_MARKERS: readonly RegExp[] = [
+  /\b(?:it|test|describe|context)\.(?:skip|todo)\b/,
+  /\bx(?:it|describe|test)\(/,
+  /#\[ignore\b/,
+  /@pytest\.mark\.skip|@unittest\.skip|\bpytest\.skip\(/,
+  /\bt\.Skip(?:Now|f)?\(/,
+  /@Disabled\b|@Ignore\b/,
+];
+
+const countSkips = (text: string): number =>
+  SKIP_MARKERS.reduce((n, re) => n + (text.match(new RegExp(re.source, "g"))?.length ?? 0), 0);
+
+/** Deterministic weakening signals between two versions of a test file. */
+export function weakeningSignals(before: string, after: string): WeakeningSignals {
+  return {
+    addsSkip: countSkips(after) > countSkips(before),
+    emptied: before.trim() !== "" && after.trim() === "",
+  };
+}
+
+/** Applies `edits` to `content` (first occurrence each, in order); unmatched edits are ignored. */
+export function applyEdits(
+  content: string,
+  edits: ReadonlyArray<{ oldText: string; newText: string }>,
+): string {
+  return edits.reduce((text, e) => {
+    const at = text.indexOf(e.oldText);
+    return at < 0 ? text : text.slice(0, at) + e.newText + text.slice(at + e.oldText.length);
+  }, content);
+}
+
+/** True when every line of `before` still appears (with multiplicity) in `after`. */
+export function isPureAddition(before: string, after: string): boolean {
+  const remaining = new Map<string, number>();
+  for (const line of after.split("\n")) remaining.set(line, (remaining.get(line) ?? 0) + 1);
+  for (const line of before.split("\n")) {
+    const left = remaining.get(line) ?? 0;
+    if (left === 0) return false;
+    remaining.set(line, left - 1);
+  }
+  return true;
+}
+
+const DELETERS = new Set(["rm", "unlink", "trash", "rmdir"]);
+
+/** Paths a bash command removes via rm / unlink / `git rm` (best effort, per simple command). */
+export function bashDeletedPaths(command: string): string[] {
+  const paths: string[] = [];
+  let current: string[] = [];
+  const flush = () => {
+    const head = current[0] === "git" && current[1] === "rm" ? "rm" : current[0];
+    const args = current[0] === "git" ? current.slice(2) : current.slice(1);
+    if (head !== undefined && DELETERS.has(head)) {
+      paths.push(...args.filter((a) => !a.startsWith("-")));
+    }
+    current = [];
+  };
+  for (const token of parse(command)) {
+    if (typeof token === "string") current.push(token);
+    else flush();
+  }
+  flush();
+  return paths;
+}

package/src/gates/approvals.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { type Departure, parseDeparture } from "../core/departure.ts";
 import { lookupGate } from "../core/gates.ts";
+import { redactSecrets } from "../core/redact.ts";
 import { type GateId, isParseError } from "../core/types.ts";
 import { appendDecision } from "../state/decision-log.ts";
 import { DEPARTURE_ENTRY_TYPE } from "./record-departure-tool.ts";
@@ -77,7 +78,7 @@ export async function requestHardStop(req: HardStopRequest): Promise<HardStopOut
   if (!req.ctx.hasUI) return { kind: "unavailable" };
   const approved = await req.ctx.ui.confirm(
     "Development system — hard stop",
-    `${req.command}\nGate: ${req.gate}\nThis is irreversible. Approve once?`,
+    `${redactSecrets(req.command)}\nGate: ${req.gate}\nThis is irreversible. Approve once?`,
   );
   if (!approved) return { kind: "declined" };
   const at = (req.now ?? (() => new Date()))();
@@ -86,8 +87,8 @@ export async function requestHardStop(req: HardStopRequest): Promise<HardStopOut
     gate: req.gate,
     tier: "hard",
     default: lookupGate(req.gate)?.default ?? "hard stop",
-    chosen: req.command,
-    why: req.why,
+    chosen: redactSecrets(req.command),
+    why: redactSecrets(req.why),
     costIfWrong: "an irreversible git operation is performed",
     approver: "user",
     scope: { kind: "once", toolCallId: req.toolCallId },

package/src/gates/git-guard.ts

@@ -1,6 +1,13 @@
-import { type ExtensionAPI, isToolCallEventType } from "@earendil-works/pi-coding-agent";
+import {
+  type ExtensionAPI,
+  type ExtensionContext,
+  isToolCallEventType,
+} from "@earendil-works/pi-coding-agent";
 import { classifyGitCommand, type GitIntent } from "../core/git-intent.ts";
+import { redactSecrets } from "../core/redact.ts";
 import { isParseError, parseGateId } from "../core/types.ts";
+import type { Jev } from "../jev/client.ts";
+import { judgeShellIntent } from "../jev/questions/shell-intent.ts";
 import { type ApprovalStore, requestHardStop } from "./approvals.ts";
 
 const HARD: ReadonlySet<GitIntent> = new Set([
@@ -11,14 +18,42 @@ const HARD: ReadonlySet<GitIntent> = new Set([
   "no-verify",
 ]);
 
-export type GitGuardDeps = { pi: ExtensionAPI; approvals: ApprovalStore; now?: () => Date };
+export type GitGuardDeps = {
+  pi: ExtensionAPI;
+  approvals: ApprovalStore;
+  /** Jev for the current context; absent means the deterministic fast path only. */
+  jev?: (ctx: ExtensionContext) => Jev;
+  now?: () => Date;
+};
 
 /** Registers the `tool_call` hard stop for irreversible git operations in bash. */
 export function registerGitGuard(deps: GitGuardDeps): void {
   deps.pi.on("tool_call", async (event, ctx) => {
     if (!isToolCallEventType("bash", event)) return undefined;
     const command = event.input.command;
-    const intent = classifyGitCommand(command);
+    let intent = classifyGitCommand(command);
+    if (intent === "unknown") {
+      const judged =
+        deps.jev === undefined ? undefined : await judgeShellIntent(deps.jev(ctx), command);
+      if (judged?.ok === true && judged.value.intent !== "unknown") {
+        intent = judged.value.intent;
+      } else {
+        const approved = ctx.hasUI
+          ? await ctx.ui.confirm(
+              "Development system — unclassified command",
+              `${redactSecrets(command)}\nCould not classify this command (Jev ${judged?.ok === false ? `unavailable: ${judged.error.kind}` : "not confident"}). It may run an irreversible git operation. Approve?`,
+            )
+          : false;
+        return approved
+          ? undefined
+          : {
+              block: true,
+              reason: ctx.hasUI
+                ? "the user declined an unclassifiable command; propose a simpler, explicit git command"
+                : "could not classify this command and Jev is unavailable or unsure; run interactively or use an explicit git command",
+            };
+      }
+    }
     if (!HARD.has(intent)) return undefined;
     const gate = parseGateId(`git.${intent}`);
     if (isParseError(gate)) return { block: true, reason: gate.message };

package/src/gates/record-departure-tool.ts

@@ -2,6 +2,7 @@ import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-age
 import { type Static, Type } from "typebox";
 import { parseDeparture, renderDepartureMarkdown } from "../core/departure.ts";
 import { gateIds, lookupGate } from "../core/gates.ts";
+import { redactSecrets } from "../core/redact.ts";
 import { isParseError, parseGateId } from "../core/types.ts";
 import { appendDecision } from "../state/decision-log.ts";
 import type { SessionState } from "../state/session-state.ts";
@@ -73,12 +74,14 @@ export function createRecordDepartureTool(
         gate,
         tier: info.tier,
         default: info.default,
-        chosen: params.chosen,
-        why: params.why,
-        costIfWrong: params.costIfWrong,
+        chosen: redactSecrets(params.chosen),
+        why: redactSecrets(params.why),
+        costIfWrong: redactSecrets(params.costIfWrong),
         approver: "agent",
         scope,
-        ...(params.revisitWhen !== undefined ? { revisitWhen: params.revisitWhen } : {}),
+        ...(params.revisitWhen !== undefined
+          ? { revisitWhen: redactSecrets(params.revisitWhen) }
+          : {}),
         recordedAt: recordedAt.toISOString().replace(/\.\d{3}Z$/, "Z"),
       });
       if (isParseError(departure)) return fail(departure.message);

package/src/gates/request-approval-tool.ts

@@ -33,7 +33,7 @@ export function createRequestApprovalTool(
     exposure: "direct",
     async execute(toolCallId, params: Static<typeof Parameters>, _signal, _onUpdate, ctx) {
       const gate = parseGateId(params.gate);
-      if (isParseError(gate) || lookupGate(gate)?.tier !== "hard") {
+      if (isParseError(gate) || gate.includes(":") || lookupGate(gate)?.tier !== "hard") {
         const hard = gateIds().filter((id) => lookupGate(id)?.tier === "hard");
         return text(`"${params.gate}" is not a hard gate. Hard gates: ${hard.join(", ")}`, true);
       }

package/src/gates/test-guard.ts

@@ -0,0 +1,176 @@
+import { readFileSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+import {
+  type ExtensionAPI,
+  type ExtensionContext,
+  isToolCallEventType,
+} from "@earendil-works/pi-coding-agent";
+import { isTestPath } from "../core/test-paths.ts";
+import {
+  applyEdits,
+  bashDeletedPaths,
+  isPureAddition,
+  weakeningSignals,
+} from "../core/test-weakening.ts";
+import { type GateId, isParseError, parseGateId } from "../core/types.ts";
+import type { Jev } from "../jev/client.ts";
+import { judgeTestChange, WEAKENS_THRESHOLD } from "../jev/questions/test-change.ts";
+import type { SessionState } from "../state/session-state.ts";
+import { type ApprovalStore, requestHardStop } from "./approvals.ts";
+
+export type TestGuardDeps = {
+  pi: ExtensionAPI;
+  state: SessionState;
+  approvals: ApprovalStore;
+  jev: (ctx: ExtensionContext) => Jev;
+  now?: () => Date;
+};
+
+type Change = { path: string; before: string; after: string | undefined };
+
+type Verdict =
+  | { kind: "allow" }
+  | { kind: "require-departure"; why: string }
+  | { kind: "hard-stop"; why: string };
+
+const GATE_ID = "tests.weaken";
+
+const describeSignals = (
+  deleted: boolean,
+  signals: { addsSkip: boolean; emptied: boolean },
+): string | undefined => {
+  if (deleted) return "deletes the test file";
+  if (signals.addsSkip) return "skips tests";
+  if (signals.emptied) return "empties the test file";
+  return undefined;
+};
+
+const readIfExists = (file: string): string | undefined => {
+  try {
+    return readFileSync(file, "utf8");
+  } catch {
+    return undefined;
+  }
+};
+
+const repoPath = (cwd: string, path: string): string =>
+  isAbsolute(path) ? relative(cwd, path) : path;
+
+/**
+ * Soft gate `tests.weaken`: deleting, skipping, emptying or loosening tests needs a recorded
+ * departure; a change Jev reads as gaming a failing gate escalates to a hard stop.
+ */
+export function registerTestGuard(deps: TestGuardDeps): void {
+  const gate: GateId | undefined = (() => {
+    const parsed = parseGateId(GATE_ID);
+    return isParseError(parsed) ? undefined : parsed;
+  })();
+  if (gate === undefined) return;
+
+  const hasOpenDeparture = (): boolean => {
+    const { openDepartures, activeSlice } = deps.state.get();
+    return openDepartures.some(
+      (d) => d.gate === gate && (d.scope.kind !== "slice" || d.scope.slice === activeSlice),
+    );
+  };
+
+  const consumeOpenDeparture = (): void => {
+    const { openDepartures, activeSlice } = deps.state.get();
+    const used = openDepartures.find(
+      (d) => d.gate === gate && (d.scope.kind !== "slice" || d.scope.slice === activeSlice),
+    );
+    if (used?.scope.kind !== "once") return;
+    deps.state.update((s) => ({
+      ...s,
+      openDepartures: s.openDepartures.filter((d) => d.id !== used.id),
+    }));
+  };
+
+  const judge = async (change: Change, ctx: ExtensionContext): Promise<Verdict> => {
+    const deleted = change.after === undefined;
+    if (!deleted && isPureAddition(change.before, change.after ?? "")) return { kind: "allow" };
+    const signals = deleted
+      ? { addsSkip: false, emptied: false }
+      : weakeningSignals(change.before, change.after ?? "");
+    const deterministic = describeSignals(deleted, signals);
+    const judged = await judgeTestChange(deps.jev(ctx), {
+      path: change.path,
+      before: change.before,
+      ...(change.after !== undefined ? { after: change.after } : {}),
+    });
+    if (judged.ok && judged.value.weakens >= WEAKENS_THRESHOLD) {
+      return judged.value.motive === "gate-gaming"
+        ? {
+            kind: "hard-stop",
+            why: "Jev reads this change as weakening a check to get a green result",
+          }
+        : {
+            kind: "require-departure",
+            why: `Jev reads this change as weakening the tests (motive: ${judged.value.motive})`,
+          };
+    }
+    return deterministic !== undefined
+      ? { kind: "require-departure", why: `this change ${deterministic}` }
+      : { kind: "allow" };
+  };
+
+  deps.pi.on("tool_call", async (event, ctx) => {
+    const changes: Change[] = [];
+    if (isToolCallEventType("bash", event)) {
+      for (const raw of bashDeletedPaths(event.input.command)) {
+        const path = repoPath(ctx.cwd, raw);
+        if (!isTestPath(path)) continue;
+        changes.push({ path, before: readIfExists(join(ctx.cwd, path)) ?? "", after: undefined });
+      }
+    } else if (isToolCallEventType("write", event) || isToolCallEventType("edit", event)) {
+      const path = repoPath(ctx.cwd, event.input.path);
+      if (!isTestPath(path)) return undefined;
+      const before = readIfExists(join(ctx.cwd, path));
+      if (before === undefined) return undefined;
+      const after = isToolCallEventType("write", event)
+        ? event.input.content
+        : applyEdits(before, event.input.edits);
+      changes.push({ path, before, after });
+    } else {
+      return undefined;
+    }
+
+    for (const change of changes) {
+      const verdict = await judge(change, ctx);
+      if (verdict.kind === "allow") continue;
+      if (verdict.kind === "require-departure") {
+        if (hasOpenDeparture()) {
+          consumeOpenDeparture();
+          continue;
+        }
+        return {
+          block: true,
+          reason:
+            `${GATE_ID}: ${verdict.why} (${change.path}). Tests are the oracle; weakening them needs a ` +
+            `recorded decision. If this is deliberate, call devsys_record_departure with gate "${GATE_ID}", ` +
+            "what you are doing instead, why, and the cost if wrong; then retry. Otherwise fix the code, not the test.",
+        };
+      }
+      const command = `${isToolCallEventType("bash", event) ? "delete" : "change"} ${change.path}`;
+      if (deps.approvals.consume(gate, command)) continue;
+      const outcome = await requestHardStop({
+        pi: deps.pi,
+        ctx,
+        gate,
+        command,
+        why: verdict.why,
+        toolCallId: event.toolCallId,
+        ...(deps.now !== undefined ? { now: deps.now } : {}),
+      });
+      if (outcome.kind === "approved") continue;
+      return {
+        block: true,
+        reason:
+          outcome.kind === "unavailable"
+            ? `hard stop ${GATE_ID}: ${verdict.why} (${change.path}); requires user approval; run interactively`
+            : `hard stop ${GATE_ID}: the user declined this change to ${change.path}. Fix the code instead of weakening the test.`,
+      };
+    }
+    return undefined;
+  });
+}

package/src/jev/client.ts

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import type {
+  ClassifierAnswer,
+  ClassifierApi,
+  ClassifierContext,
+  ClassifierModel,
+  ClassifierQuestion,
+  ClassifierResult,
+  JsonObject,
+} from "@earendil-works/pi-ai";
+import { err, ok, type Result } from "../core/result.ts";
+import { splitModelRef } from "./models.ts";
+
+export type JevAvailability = "online" | "offline" | "unknown";
+export type JevError =
+  | { kind: "no-model" }
+  | { kind: "timeout" }
+  | { kind: "provider"; message: string }
+  | { kind: "aborted" };
+
+type Classifier = ClassifierModel<ClassifierApi>;
+
+/** The slice of pi's `ctx.modelRegistry` that Jev needs; tests pass a fake. */
+export interface ClassifierRegistry {
+  findOfType(type: "classifier", provider: string, modelId: string): Classifier | undefined;
+  // biome-ignore lint/suspicious/noExplicitAny: structural bridge to the host's Model<Api> parameter
+  hasConfiguredAuth(model: any): boolean;
+  classify(
+    model: Classifier,
+    context: ClassifierContext,
+    options?: { signal?: AbortSignal },
+  ): Promise<ClassifierResult>;
+}
+
+export type JevOptions = {
+  registry: ClassifierRegistry;
+  candidates: readonly string[];
+  timeoutMs: number;
+  cache: Map<string, ClassifierResult>;
+  now(): number;
+};
+
+export interface Jev {
+  ask(
+    state: JsonObject,
+    questions: Record<string, ClassifierQuestion>,
+  ): Promise<Result<Record<string, ClassifierAnswer>, JevError>>;
+  availability(): JevAvailability;
+  model(): string | undefined;
+}
+
+/** First candidate `provider/id` that exists in the registry AND has configured auth. */
+export function resolveJevModel(
+  registry: ClassifierRegistry,
+  candidates: readonly string[],
+): Classifier | undefined {
+  for (const ref of candidates) {
+    const parts = splitModelRef(ref);
+    if (parts === undefined) continue;
+    const model = registry.findOfType("classifier", parts.provider, parts.id);
+    if (model !== undefined && registry.hasConfiguredAuth(model)) return model;
+  }
+  return undefined;
+}
+
+const hashOf = (state: JsonObject, questions: Record<string, ClassifierQuestion>): string =>
+  createHash("sha256").update(JSON.stringify({ state, questions })).digest("hex");
+
+/** Wraps the host classifier: model resolution, timeout, caching and typed errors. Never rejects. */
+export function createJev(opts: JevOptions): Jev {
+  let availability: JevAvailability = "unknown";
+  let current: string | undefined;
+
+  const run = async (
+    model: Classifier,
+    context: ClassifierContext,
+  ): Promise<Result<ClassifierResult, JevError>> => {
+    const controller = new AbortController();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<"timeout">((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve("timeout");
+      }, opts.timeoutMs);
+    });
+    try {
+      const outcome = await Promise.race([
+        opts.registry.classify(model, context, { signal: controller.signal }),
+        timeout,
+      ]);
+      if (outcome === "timeout") return err({ kind: "timeout" });
+      if (outcome.stopReason === "aborted") return err({ kind: "aborted" });
+      if (outcome.stopReason === "error")
+        return err({ kind: "provider", message: outcome.errorMessage ?? "classifier error" });
+      return ok(outcome);
+    } catch (e) {
+      return err({ kind: "provider", message: e instanceof Error ? e.message : String(e) });
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+    }
+  };
+
+  return {
+    async ask(state, questions) {
+      const model = resolveJevModel(opts.registry, opts.candidates);
+      if (model === undefined) {
+        availability = "offline";
+        current = undefined;
+        return err({ kind: "no-model" });
+      }
+      current = `${model.provider}/${model.id}`;
+      const key = hashOf(state, questions);
+      const cached = opts.cache.get(key);
+      if (cached !== undefined) return ok(cached.answers);
+      const result = await run(model, { state, questions });
+      if (!result.ok) {
+        availability = result.error.kind === "aborted" ? availability : "offline";
+        return result;
+      }
+      availability = "online";
+      opts.cache.set(key, result.value);
+      return ok(result.value.answers);
+    },
+    availability: () => availability,
+    model: () => current,
+  };
+}

package/src/jev/holder.ts

@@ -0,0 +1,54 @@
+import type { ClassifierResult } from "@earendil-works/pi-ai";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+  type ClassifierRegistry,
+  createJev,
+  type Jev,
+  type JevAvailability,
+  resolveJevModel,
+} from "./client.ts";
+import { DEFAULT_JEV_CANDIDATES } from "./models.ts";
+
+export type JevHolder = {
+  /** The Jev bound to this context's model registry (one per registry, shared cache). */
+  forContext(ctx: Pick<ExtensionContext, "modelRegistry">): Jev;
+  /** Cheap, offline probe of whether a Jev credential is configured. */
+  probe(ctx: Pick<ExtensionContext, "modelRegistry">): {
+    availability: JevAvailability;
+    model: string | undefined;
+  };
+};
+
+export function createJevHolder(opts?: {
+  candidates?: readonly string[];
+  timeoutMs?: number;
+  now?: () => number;
+}): JevHolder {
+  const candidates = opts?.candidates ?? DEFAULT_JEV_CANDIDATES;
+  const cache = new Map<string, ClassifierResult>();
+  const bound = new WeakMap<object, Jev>();
+  const registryOf = (ctx: Pick<ExtensionContext, "modelRegistry">): ClassifierRegistry =>
+    ctx.modelRegistry;
+  return {
+    forContext(ctx) {
+      const registry = registryOf(ctx);
+      const existing = bound.get(registry);
+      if (existing !== undefined) return existing;
+      const jev = createJev({
+        registry,
+        candidates,
+        timeoutMs: opts?.timeoutMs ?? 15_000,
+        cache,
+        now: opts?.now ?? Date.now,
+      });
+      bound.set(registry, jev);
+      return jev;
+    },
+    probe(ctx) {
+      const model = resolveJevModel(registryOf(ctx), candidates);
+      return model === undefined
+        ? { availability: "offline", model: undefined }
+        : { availability: "online", model: `${model.provider}/${model.id}` };
+    },
+  };
+}

package/src/jev/models.ts

@@ -0,0 +1,15 @@
+/** Default Jev classifier candidates, tried in order; overridable by `[models] jev`. */
+export const DEFAULT_JEV_CANDIDATES: readonly string[] = [
+  "typesafe/jev-latest",
+  "openrouter/typesafe/jev-latest",
+  "opencode/jev-1.13",
+  "cloudflare-workers-ai/typesafe/jev",
+  "vercel-ai-gateway/typesafe-ai/jev",
+];
+
+/** Splits `provider/id` on the first slash (ids may themselves contain slashes). */
+export function splitModelRef(ref: string): { provider: string; id: string } | undefined {
+  const at = ref.indexOf("/");
+  if (at <= 0 || at === ref.length - 1) return undefined;
+  return { provider: ref.slice(0, at), id: ref.slice(at + 1) };
+}

package/src/jev/questions/shell-intent.ts

@@ -0,0 +1,55 @@
+import type { ClassifierChoiceQuestion } from "@earendil-works/pi-ai";
+import type { GitIntent } from "../../core/git-intent.ts";
+import { err, ok, type Result } from "../../core/result.ts";
+import type { Jev, JevError } from "../client.ts";
+
+export const SHELL_INTENT_THRESHOLD = 0.6;
+
+export const SHELL_INTENT_QUESTION: ClassifierChoiceQuestion = {
+  type: "choice",
+  instructions:
+    "A coding agent is about to run the shell command in `command`. Which irreversible git operation, if any, would running it perform? Consider wrappers, subshells, variables, pipes and scripts. Choose `ordinary` when it performs none of them (including commands that only mention git text).",
+  criteria: {
+    "force-push":
+      "Pushes with --force, --force-with-lease, --mirror, or a +refspec, overwriting remote history",
+    "branch-delete-remote": "Deletes a branch or tag on a remote (push --delete, push :ref)",
+    "history-rewrite": "Rewrites local history: commit --amend, rebase, filter-branch, filter-repo",
+    "destructive-reset":
+      "Discards work irrecoverably: reset --hard, clean -fd, checkout -- . over uncommitted changes",
+    "no-verify":
+      "Skips commit/push hooks: --no-verify, -n on commit, core.hooksPath override, LEFTHOOK=0 / HUSKY=0",
+    ordinary: "None of the above; read-only or reversible work",
+  },
+};
+
+const INTENTS: readonly GitIntent[] = [
+  "force-push",
+  "branch-delete-remote",
+  "history-rewrite",
+  "destructive-reset",
+  "no-verify",
+  "ordinary",
+];
+
+const isIntent = (value: string): value is GitIntent => INTENTS.some((i) => i === value);
+
+/** Pure policy: a confident Jev choice maps to its intent; low confidence or an unknown label → `unknown`. */
+export function intentFromChoice(choice: string, confidence: number): GitIntent {
+  if (confidence < SHELL_INTENT_THRESHOLD) return "unknown";
+  return isIntent(choice) ? choice : "unknown";
+}
+
+export async function judgeShellIntent(
+  jev: Jev,
+  command: string,
+): Promise<Result<{ intent: GitIntent; confidence: number }, JevError>> {
+  const asked = await jev.ask({ command }, { intent: SHELL_INTENT_QUESTION });
+  if (!asked.ok) return asked;
+  const answer = asked.value.intent;
+  if (answer?.type !== "choice")
+    return err({ kind: "provider", message: "missing shell-intent answer" });
+  return ok({
+    intent: intentFromChoice(answer.choice, answer.confidence),
+    confidence: answer.confidence,
+  });
+}

package/src/jev/questions/test-change.ts

@@ -0,0 +1,76 @@
+import type { ClassifierBoolQuestion, ClassifierChoiceQuestion } from "@earendil-works/pi-ai";
+import { err, ok, type Result } from "../../core/result.ts";
+import type { Jev, JevError } from "../client.ts";
+
+export const WEAKENS_THRESHOLD = 0.7;
+export const MOTIVE_THRESHOLD = 0.6;
+
+export type TestChangeMotive = "requirement-change" | "gate-gaming" | "refactor" | "unclear";
+export type TestChangeInput = {
+  path: string;
+  before?: string;
+  after?: string;
+  recentFailure?: string;
+};
+
+export const WEAKENS_QUESTION: ClassifierBoolQuestion = {
+  type: "bool",
+  instructions:
+    "Does the change to the test file in `path` (from `before` to `after`; `after` absent means deleted) weaken what the tests verify — removing or loosening assertions, skipping or deleting tests, widening expected values, or catching and ignoring failures?",
+  criteria: {
+    true: "The tests verify less behaviour afterwards (assertions removed or loosened, tests skipped, disabled or deleted)",
+    false:
+      "The tests verify the same or more behaviour (added tests, stronger assertions, renames, pure refactors)",
+  },
+};
+
+export const MOTIVE_QUESTION: ClassifierChoiceQuestion = {
+  type: "choice",
+  instructions:
+    "Why is the test file in `path` being changed from `before` to `after`? `recentFailure` is the most recent failing output, if any. Choose `gate-gaming` only when the change makes a failing check pass by weakening the check instead of fixing the code.",
+  criteria: {
+    "requirement-change":
+      "The behaviour under test was deliberately changed, so the test must change with it",
+    "gate-gaming": "A failing test is being weakened, skipped or deleted to get a green result",
+    refactor: "Structure of the test changes with no change in what is verified",
+    unclear: "Cannot tell from the evidence",
+  },
+};
+
+const MOTIVES: readonly TestChangeMotive[] = [
+  "requirement-change",
+  "gate-gaming",
+  "refactor",
+  "unclear",
+];
+const isMotive = (value: string): value is TestChangeMotive => MOTIVES.some((m) => m === value);
+
+/** Pure policy: low confidence or an unexpected label → `unclear`. */
+export const motiveFromChoice = (choice: string, confidence: number): TestChangeMotive =>
+  confidence >= MOTIVE_THRESHOLD && isMotive(choice) ? choice : "unclear";
+
+export async function judgeTestChange(
+  jev: Jev,
+  input: TestChangeInput,
+): Promise<Result<{ weakens: number; motive: TestChangeMotive; confidence: number }, JevError>> {
+  const clip = (text: string | undefined): string => (text ?? "").slice(0, 6000);
+  const state = {
+    path: input.path,
+    before: clip(input.before),
+    after: input.after === undefined ? "" : clip(input.after),
+    deleted: input.after === undefined,
+    recentFailure: clip(input.recentFailure),
+  };
+  const asked = await jev.ask(state, { weakens: WEAKENS_QUESTION, motive: MOTIVE_QUESTION });
+  if (!asked.ok) return asked;
+  const weakens = asked.value.weakens;
+  const motive = asked.value.motive;
+  if (weakens?.type !== "bool" || motive?.type !== "choice") {
+    return err({ kind: "provider", message: "missing test-change answers" });
+  }
+  return ok({
+    weakens: weakens.probability,
+    motive: motiveFromChoice(motive.choice, motive.confidence),
+    confidence: motive.confidence,
+  });
+}