jevgate 0.1.0

package/README.md

@@ -0,0 +1,27 @@
+# jevgate
+
+Your agent stops to ask permission. jevgate answers in ~300 ms — with a
+probability, a risk score, and an audit log. It escalates what it isn't sure
+about. **It never denies.**
+
+```
+npx -y jevgate init          # writes the PermissionRequest hook for Codex and Claude Code
+jevgate login <token>        # free token at https://jevgate.dev
+jevgate status               # plan, usage, endpoint
+jevgate log                  # your last decisions, locally
+```
+
+Codex runs a new hook only after you trust it once — open codex and accept the
+jevgate hook when it asks. Claude Code only prompts outside auto mode; jevgate
+answers those prompts.
+
+How a decision is made: the request (the command, the task you gave the agent,
+the working directory) goes to jevgate's endpoint, which asks Jev — TypeSafe's
+decision-only model — four typed questions in one ~300 ms call: should this be
+allowed, how risky is it (four levels), how clearly did you authorise it, and
+what kind of action it is. jevgate allows only when risk is low with high
+confidence and the action isn't an install or anything destructive. Anything
+else, and any error or timeout, returns nothing — your harness then does
+exactly what it does today.
+
+Powered by Jev (TypeSafe). Not affiliated with TypeSafe, OpenAI, or Anthropic.

package/jevgate.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+// jevgate — one binary, zero dependencies.
+//   jevgate init      write the hooks into Claude Code and codex
+//   jevgate login     store your token
+//   jevgate decide    (called by the harness) stdin JSON → decision JSON or nothing
+//   jevgate status    endpoint, token, usage
+//   jevgate log       last decisions
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const HOME = os.homedir();
+const DIR = path.join(HOME, ".jevgate");
+const CONFIG = path.join(DIR, "config.json");
+const LOG = path.join(DIR, "decisions.jsonl");
+const endpoint = () => process.env.JEVGATE_ENDPOINT || config().endpoint || "https://jevgate.dev";
+const TIMEOUT_MS = Number(process.env.JEVGATE_TIMEOUT_MS || 2500);
+// The hook runs on every permission request, so it must not pay npx's resolver
+// each time. Write the absolute path of this very script: it is stable whether
+// we were installed globally (npm i -g jevgate) or are running from npx's cache.
+const SELF = new URL(import.meta.url).pathname;
+const HOOK_CMD = `node "${SELF}" decide`;
+
+const readJson = (p, fallback) => { try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return fallback; } };
+const writeJson = (p, v) => { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(v, null, 2) + "\n"); };
+const config = () => readJson(CONFIG, {});
+
+// ---------------------------------------------------------------- decide
+async function decide() {
+  let input = "";
+  for await (const chunk of process.stdin) input += chunk;
+  if (process.env.JEVGATE_DEBUG) { try { fs.mkdirSync(DIR, { recursive: true }); fs.appendFileSync(path.join(DIR, "raw-events.jsonl"), input.trim() + "\n"); } catch {} }
+  let event;
+  try { event = JSON.parse(input); } catch { appendLog({ ts: new Date().toISOString(), outcome: "bad_stdin", bytes: input.length, head: input.slice(0, 120) }); return; }
+  const cfg = config();
+  const token = process.env.JEVGATE_TOKEN || cfg.token;
+  if (!token) { appendLog({ ...meta(event, Date.now()), outcome: "no_token" }); return; }   // not logged in → harness proceeds as usual
+  const started = Date.now();
+  const body = {
+    harness: detectHarness(event),
+    event: event.hook_event_name,
+    tool_name: event.tool_name,
+    tool_input: event.tool_input,
+    cwd: event.cwd,
+    permission_mode: event.permission_mode,
+    task: await recentUserPrompt(event.transcript_path) ?? codexTask(event.session_id),
+  };
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  let result;
+  try {
+    const res = await fetch(`${endpoint()}/api/v1/decide`, {
+      method: "POST", signal: ctrl.signal,
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) { appendLog({ ...meta(event, started), outcome: "error", status: res.status }); return; }
+    result = await res.json();
+  } catch (err) {
+    appendLog({ ...meta(event, started), outcome: "error", error: String(err?.name || err) });
+    return;                                                        // any failure → harness proceeds as usual
+  } finally { clearTimeout(timer); }
+
+  appendLog({ ...meta(event, started), ...result });
+  if (result.decision !== "allow") return;                         // ask/uncertain → say nothing, never deny
+  const reason = `jevgate: allow (p=${result.p_allow}, risk=${result.risk}) — ${result.kind}`;
+  const out = event.hook_event_name === "PermissionRequest"
+    ? { hookSpecificOutput: { hookEventName: "PermissionRequest", decision: { behavior: "allow", message: reason } } }
+    : { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } };
+  process.stdout.write(JSON.stringify(out));
+}
+
+const meta = (event, started) => ({
+  ts: new Date().toISOString(), harness: detectHarness(event), event: event.hook_event_name,
+  tool: event.tool_name, cmd: summarize(event.tool_input), latency_ms: Date.now() - started,
+});
+const detectHarness = (e) => (e.session_id && e.turn_id) ? "codex" : "claude-code";
+const summarize = (ti) => { if (!ti) return ""; const c = ti.command || ti.cmd || ti.file_path || ti.path || ""; return String(Array.isArray(c) ? c.join(" ") : c).slice(0, 160); };
+function appendLog(rec) { try { fs.mkdirSync(DIR, { recursive: true }); fs.appendFileSync(LOG, JSON.stringify(rec) + "\n"); } catch {} }
+
+// The latest user message: what the agent is trying to do. Read cheaply from the
+// transcript when the harness gives one; Jev needs the task to judge the action.
+async function recentUserPrompt(transcriptPath) {
+  if (!transcriptPath) return null;
+  try {
+    const text = fs.readFileSync(transcriptPath, "utf8");
+    const lines = text.split("\n").filter(Boolean).slice(-400);
+    for (let i = lines.length - 1; i >= 0; i--) {
+      let o; try { o = JSON.parse(lines[i]); } catch { continue; }
+      const m = o.message || o;
+      if ((o.type === "user" || m.role === "user") && m.content) {
+        const c = Array.isArray(m.content) ? m.content.map(x => x.text || "").join("\n") : String(m.content);
+        if (c.trim() && !c.startsWith("<")) return c.slice(0, 1500);
+      }
+    }
+  } catch {}
+  return null;
+}
+
+// codex's PermissionRequest payload carries no transcript, but the session
+// rollout is on disk: ~/.codex/sessions/YYYY/MM/DD/rollout-<ts>-<session_id>.jsonl.
+// The latest real user message (harness-injected ones start with "<") is the task.
+function codexTask(sessionId) {
+  if (!sessionId) return null;
+  try {
+    const root = path.join(HOME, ".codex", "sessions");
+    const day = (d) => path.join(root, String(d.getUTCFullYear()), String(d.getUTCMonth() + 1).padStart(2, "0"), String(d.getUTCDate()).padStart(2, "0"));
+    let file = null;
+    for (let back = 0; back < 3 && !file; back++) {
+      const dir = day(new Date(Date.now() - back * 864e5));
+      if (!fs.existsSync(dir)) continue;
+      const hit = fs.readdirSync(dir).find((f) => f.endsWith(`${sessionId}.jsonl`));
+      if (hit) file = path.join(dir, hit);
+    }
+    if (!file) return null;
+    const lines = fs.readFileSync(file, "utf8").split("\n").filter(Boolean).slice(-600);
+    for (let i = lines.length - 1; i >= 0; i--) {
+      let o; try { o = JSON.parse(lines[i]); } catch { continue; }
+      const pl = o.payload;
+      if (o.type !== "response_item" || !pl || pl.type !== "message" || pl.role !== "user") continue;
+      const text = (pl.content || []).filter((c) => c.type === "input_text").map((c) => c.text).join("\n").trim();
+      if (text && !text.startsWith("<")) return text.slice(0, 1500);
+    }
+  } catch {}
+  return null;
+}
+
+// ---------------------------------------------------------------- init
+function init() {
+  const results = [];
+  // Claude Code: PermissionRequest fires exactly when a permission prompt would
+  // appear. Allowing there skips the prompt; saying nothing shows it as usual.
+  const claude = path.join(HOME, ".claude", "settings.json");
+  if (fs.existsSync(path.dirname(claude))) {
+    const s = readJson(claude, {});
+    s.hooks ||= {};
+    results.push(addHook(s.hooks, "PermissionRequest", "*", 5) ? "claude-code: PermissionRequest hook added" : "claude-code: already installed");
+    writeJson(claude, s);
+  } else results.push("claude-code: not found (~/.claude)");
+  // codex: PermissionRequest fires only when codex would ask a human or Guardian.
+  const codex = path.join(HOME, ".codex", "hooks.json");
+  if (fs.existsSync(path.dirname(codex))) {
+    const h = readJson(codex, { hooks: {} });
+    h.hooks ||= {};
+    const added = addHook(h.hooks, "PermissionRequest", undefined, 5);
+    results.push(added ? "codex: PermissionRequest hook added" : "codex: already installed");
+    writeJson(codex, h);
+    // codex runs a hook only after you trust it once. It asks on the next start.
+    if (added) results.push("codex: open codex once and accept the jevgate hook when it asks (it verifies new hooks)");
+  } else results.push("codex: not found (~/.codex)");
+  for (const r of results) console.log("  " + r);
+  if (!config().token) console.log("\n  next: jevgate login <token>   (free at https://jevgate.dev)");
+}
+const isOurs = (h) => /jevgate(\.js)?"? decide\b/.test(h?.command || "");
+// Idempotent: one jevgate group per event, always pointing at this script.
+function addHook(hooks, eventName, matcher, timeout) {
+  hooks[eventName] ||= [];
+  const before = hooks[eventName].length;
+  hooks[eventName] = hooks[eventName].filter(g => !(g.hooks || []).some(isOurs));
+  const group = { hooks: [{ type: "command", command: HOOK_CMD, timeout }] };
+  if (matcher) group.matcher = matcher;
+  hooks[eventName].push(group);
+  return hooks[eventName].length > before;   // true only when nothing of ours was there
+}
+
+// ---------------------------------------------------------------- misc
+function login(token) {
+  if (!token) { console.error("usage: jevgate login <token>"); process.exit(1); }
+  writeJson(CONFIG, { ...config(), token, endpoint: endpoint() });
+  console.log("  token saved to ~/.jevgate/config.json");
+}
+async function status() {
+  const cfg = config();
+  console.log(`  endpoint  ${endpoint()}`);
+  console.log(`  token     ${cfg.token ? cfg.token.slice(0, 8) + "…" : "(none — run: jevgate login <token>)"}`);
+  const n = fs.existsSync(LOG) ? fs.readFileSync(LOG, "utf8").split("\n").filter(Boolean) : [];
+  const allowed = n.filter(l => l.includes('"decision":"allow"')).length;
+  console.log(`  decisions ${n.length} logged locally, ${allowed} allowed by jevgate`);
+  if (cfg.token) {
+    try {
+      const r = await fetch(`${endpoint()}/api/v1/me`, { headers: { authorization: `Bearer ${cfg.token}` } });
+      if (r.ok) { const me = await r.json(); console.log(`  plan      ${me.plan}  ${me.used}/${me.limit === null ? "∞" : me.limit} this month`); }
+    } catch {}
+  }
+}
+function log(n = 20) {
+  const lines = fs.existsSync(LOG) ? fs.readFileSync(LOG, "utf8").split("\n").filter(Boolean).slice(-n) : [];
+  for (const l of lines) { const r = JSON.parse(l); console.log(`  ${r.ts.slice(11, 19)}  ${(r.decision || r.outcome || "-").padEnd(6)} ${String(r.latency_ms).padStart(5)}ms  ${r.harness.padEnd(11)} ${r.cmd}`); }
+}
+
+const [cmd, arg] = process.argv.slice(2);
+({ decide, init, login: () => login(arg), status, log: () => log(Number(arg) || 20) }[cmd] ||
+  (() => console.log("usage: jevgate <init|login <token>|decide|status|log>")))();

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "jevgate",
+  "version": "0.1.0",
+  "description": "Auto-approve the benign majority of agent tool calls in ~300ms, with a probability and an audit log. Escalates the rest. Never denies.",
+  "keywords": [
+    "codex",
+    "claude-code",
+    "agent",
+    "permissions",
+    "hooks",
+    "approval",
+    "jev",
+    "typesafe"
+  ],
+  "homepage": "https://jevgate.dev",
+  "author": "remotehost <matt@remotehost.ai> (https://remotehost.ai)",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "jevgate": "./jevgate.js"
+  },
+  "files": [
+    "jevgate.js",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}