ohmyjev 0.3.2 → 0.5.0

package/README.md

@@ -58,12 +58,13 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 
 | Feature | What it does |
 |---|---|
-| **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more, or destructive at 0.7 or more. |
+| **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more, or when it sends local files or secrets to an outside host (0.7), such as `curl` uploading `~/.ssh`. A command Jev calls irreversible with less confidence is denied too when it also aims to wipe something (0.7). Reversible work always passes, so deleting lines, dropping a co-author trailer or uninstalling a plugin goes through. Plain reads like `ls`, `git status` or `grep` skip Jev entirely: plain code checks them, so they cost nothing and wait for nothing. |
 | **Write gate** | Denies writes outside the repo and `allowPaths`, and writes that contain a real credential. The repo means every worktree of the one the session started in, and every worktree of a repo the agent has moved into. The path check is plain code, not Jev, and it follows symlinks the way the OS does. |
 | **Exfil gate** | Denies a WebFetch or MCP call when Jev rates it 0.7 or more for sending your local data, files or credentials out. |
 | **Policies** | Every gate also checks the call against your own rules in the `policies` setting. |
+| **Your request** | Every gate also asks Jev whether your latest message asked for exactly this call. If it did (0.8), a gate's Jev deny lets the call through. So "delete the build folder" or "force push it" works, while the same command picked by the agent on its own is still denied. After a block, a plain "yes" works too: the gate shows Jev the call it just blocked next to your reply. Policy and path denies always stand. |
 | **Injection screen** | When output from Bash, WebFetch, an MCP tool, or a Read outside the repo has instructions aimed at the model, it adds a note telling the model to treat that output as data. |
-| **Done-check** | If the agent says it's done but nothing shows it ran a check, it blocks the stop once and tells the agent to verify. |
+| **Done-check** | If the agent says it's done but nothing shows it ran a check, it blocks the stop once and tells the agent to verify. A turn that ran no tools is never blocked, since there was nothing to verify. |
 | **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
 | **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
 | **`ask_jev`** | A tool the model can use to ask Jev about repo files or text without loading them into its own context. |
@@ -193,14 +194,19 @@ Most of the time you won't notice it. Here's what it looks like when it does ste
 
 ### When a command gets blocked
 
-Claude gets the denial as the tool's result, along with an instruction not to work around it:
+Claude gets the denial as the tool's result, with an instruction not to work around it and a way out:
 
 ```
 ohmyjev blocked this: irreversible (0.95): nothing would restore what this removes or overwrites.
-This block is final. Do not try to work around it with another command, another tool, a different path,
-or an encoding that does the same thing. Stop and tell the user what was blocked and why.
+Do not try to work around it with another command, another tool, a different path, or an encoding that does
+the same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run
+exactly this again: their reply then lets it through.
 ```
 
+So when the agent stops and asks, answer "yes". The next gate shows Jev the blocked call next to your reply, so a
+yes confirms that call and nothing else. A yes with no block before it, "no", or a yes followed by a different
+command still gets denied.
+
 A write outside the repo gets a different message. It names the path and tells the model to ask you to add that
 directory to `allowPaths`, because that block is a setting, not a hazard.
 
@@ -314,7 +320,8 @@ Run `/omj settings` to see every setting's current value (the key stays hidden).
 | `logDecisions` | on | Shows each routing decision as a line in the transcript. |
 | `statusLine` | on | Pins ohmyjev's status under the prompt. |
 
-Each gate also has its own threshold setting. The defaults are the numbers in [What you get](#what-you-get).
+Each gate also has its own threshold setting, and `requested` (0.8) sets how sure Jev must be that you asked for a
+call. The defaults are the numbers in [What you get](#what-you-get).
 
 ## Logs
 
@@ -329,7 +336,7 @@ a fixed size:
 
 | What asks | What it sends |
 |---|---|
-| Bash gate | The command (up to 16000 characters), the working directory and the tool call's description |
+| Bash gate | The command (up to 16000 characters), the working directory, the tool call's description, your latest message (1500) and, right after a block, the blocked call (600). Plain reads send nothing |
 | Write gate | The file path and the new content (up to 16000 characters). Code denies writes outside the repo and `allowPaths` before it sends anything |
 | Exfil gate | The tool's name and its input (up to 4000 characters) |
 | Injection screen | The tool's output (up to 6000 characters), from Bash, WebFetch, MCP tools and Reads outside the repo |
@@ -337,7 +344,8 @@ a fixed size:
 | Router | The request (up to 1500 characters) |
 | `ask_jev` | The model's question, any text it passes (up to 20000 characters) and the repo files it names (8000 each, 80000 in total). It never sends files outside the repo |
 
-When you've set `policies`, every gate sends those too. Turning a feature off stops its calls.
+The write and exfil gates also send your latest message (1500), for the request check. When you've set `policies`,
+every gate sends those too. Turning a feature off stops its calls.
 
 With no key, nothing goes to Jev. The router's built-in classifier sends the request (up to 1500 characters) to
 Claude's own small model, over the same connection Claude Code already uses. In pi it goes to the cheapest model you
@@ -379,6 +387,7 @@ git clone https://github.com/Novacon/ohmyjev && cd ohmyjev && bun install
 claude --plugin-dir "$PWD"                  # run your working copy, and it writes the API types to .claude-plugin/types
 omp -e ./adapters/omp.ts                    # or: pi -e ./adapters/pi.ts
 bun run test && bun run typecheck && claude plugin validate .
+bun tests/live.ts                           # 28 real commands against the live Jev, with the expected verdicts
 ```
 
 The decision logic lives in `hooks/policy.ts` and is pure, so you can test it with plain tables. `hooks/ohmyjev.ts`

package/adapters/omp.ts

@@ -4,7 +4,7 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead,
   OMJ_HELP, OMJ_OFF, OMJ_ON, settingsRows, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
@@ -254,6 +254,9 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     let pushedBackAt = -1
     let route: Route | undefined
     let liveRequest = ''
+    let lastBlocked = '' // the call a gate denied this turn
+    let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let classifiedPrompt: string | undefined
     let askRegistered = false
@@ -398,6 +401,9 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
       pushedBackAt = -1
       route = undefined
       liveRequest = ''
+      userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
       classifiedPrompt = undefined
       status()
@@ -453,6 +459,9 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
       root = ''
       route = undefined
       liveRequest = ''
+      userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
       classifiedPrompt = undefined
       pushedBackAt = -1
@@ -466,6 +475,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         const tool = event.toolName
         const input = object(event.input)
         if ((tool === 'bash' || tool === 'eval' || githubWrite(tool, input)) && c.bashGate) {
+          if (tool === 'bash' && plainRead(string(input, 'command'), c)) return // code says read-only, no Jev call
           const command = tool === 'eval'
             ? string(input, 'code')
             : tool === 'github'
@@ -482,11 +492,14 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
             description: clip(description, 300),
             ...(command.length > CLIP ? { truncated: true } : {}),
           }
-          const d = await session.decide('tool_call', tool, withPolicies(state, c), withPolicyQ(BASH_Q, c))
+          const d = await session.decide('tool_call', tool, withPolicies(state, c, userRequest, blockedBefore), withPolicyQ(BASH_Q, c, userRequest))
           if (!d) return
           const judged = gateBash(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
           return
         }
         if (WRITE_TOOLS[tool] && c.writeGate) {
@@ -505,25 +518,31 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
           const path = paths.join('; ')
           const d = await session.decide(
             'tool_call', tool,
-            withPolicies({ path, content: clip(writeContent(input), CLIP) }, c),
-            withPolicyQ(WRITE_Q, c),
+            withPolicies({ path, content: clip(writeContent(input), CLIP) }, c, userRequest, blockedBefore),
+            withPolicyQ(WRITE_Q, c, userRequest),
           )
           if (!d) return
           const judged = gateWrite(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
           return
         }
         if (c.exfilGate && exfilTool(tool, input)) {
           const d = await session.decide(
             'tool_call', tool,
-            withPolicies({ tool, input: clip(safeJson(input), 4000) }, c),
-            withPolicyQ(EXFIL_Q, c),
+            withPolicies({ tool, input: clip(safeJson(input), 4000) }, c, userRequest, blockedBefore),
+            withPolicyQ(EXFIL_Q, c, userRequest),
           )
           if (!d) return
           const judged = gateExfil(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         }
       } catch {
         return
@@ -591,7 +610,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
           scheduleCompact(ctx)
           return
         }
-        const judged = judgeStop(d.answers, c)
+        const judged = judgeStop(d.answers, c, state.tools_this_turn.length > 0)
         const block = c.doneCheck ? judged.block : null
         if (block) pushedBackAt = requests.length
         if (c.autoCompact && judged.wantsCompact) compactPending = true
@@ -609,6 +628,11 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         if (ctx.agent.kind !== 'main' || !c.enabled) return
         userEffort = userThinking(ctx)
         const prompt = typeof rawEvent.prompt === 'string' ? rawEvent.prompt : ''
+        if (prompt.trim() && !/^\/\S+\s*$/.test(prompt.trim())) {
+          userRequest = prompt
+          blockedBefore = lastBlocked
+          lastBlocked = ''
+        }
         if (!prompt.trim()) return
         if (classifiedPrompt !== prompt) {
           classifiedPrompt = prompt

package/adapters/pi.ts

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText,
+  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead,
   OMJ_HELP, OMJ_OFF, OMJ_ON, settingsRows, toggleArg,
   keepInstructions, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
@@ -257,6 +257,9 @@ export function createExtension(options: PiAdapterOptions = {}) {
     let pushedBackAt = -1
     let route: Route | undefined
     let liveRequest = ''
+    let lastBlocked = '' // the call a gate denied this turn
+    let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let userThinking: ThinkingLevel = 'medium'
     let changingThinking = false
@@ -289,6 +292,9 @@ export function createExtension(options: PiAdapterOptions = {}) {
       pushedBackAt = -1
       route = undefined
       liveRequest = ''
+      userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
     }
     const setThinking = (level: ThinkingLevel): void => {
@@ -403,6 +409,11 @@ export function createExtension(options: PiAdapterOptions = {}) {
 
     pi.on('before_agent_start', guarded<BeforeAgentStartEvent, void>(async (event, ctx) => {
       latestCtx = ctx
+      if (event.prompt.trim() && !/^\/\S+\s*$/.test(event.prompt.trim())) {
+        userRequest = event.prompt
+        blockedBefore = lastBlocked
+        lastBlocked = ''
+      }
       if (!c.enabled) return
       const text = event.prompt
       if (!text.trim()) return
@@ -433,12 +444,16 @@ export function createExtension(options: PiAdapterOptions = {}) {
       const input = event.input
       if ((tool === 'bash' || tool === 'powershell') && c.bashGate) {
         const command = arg(input, 'command')
-        const state = withPolicies({ command: clip(command, CLIP), cwd: ctx.cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c)
-        const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c))
+        if (plainRead(command, c)) return // ls, git status, grep: code says read-only, no Jev call
+        const state = withPolicies({ command: clip(command, CLIP), cwd: ctx.cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, userRequest, blockedBefore)
+        const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, userRequest))
         if (!d) return
         const judged = gateBash(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         return
       }
       if ((tool === 'write' || tool === 'edit') && c.writeGate) {
@@ -448,24 +463,30 @@ export function createExtension(options: PiAdapterOptions = {}) {
           return { block: true, reason: pathDenyText(path) }
         }
         const content = tool === 'write' ? arg(input, 'content') : json(input.edits)
-        const d = await x.decide('tool.call', tool, withPolicies({ path, content: clip(content, CLIP) }, c), withPolicyQ(WRITE_Q, c))
+        const d = await x.decide('tool.call', tool, withPolicies({ path, content: clip(content, CLIP) }, c, userRequest, blockedBefore), withPolicyQ(WRITE_Q, c, userRequest))
         if (!d) return
         const judged = gateWrite(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         return
       }
       if (tool.startsWith('mcp__') && c.exfilGate) {
         const d = await x.decide(
           'tool.call',
           tool,
-          withPolicies({ tool, input: clip(json(input), 4000) }, c),
-          withPolicyQ(EXFIL_Q, c),
+          withPolicies({ tool, input: clip(json(input), 4000) }, c, userRequest, blockedBefore),
+          withPolicyQ(EXFIL_Q, c, userRequest),
         )
         if (!d) return
         const judged = gateExfil(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
       }
     }))
 
@@ -504,7 +525,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
       const questions = state.previous_requests.length ? { ...STOP_Q, ...SWITCHED_Q } : STOP_Q
       const d = await x.decide('Stop', '', state, questions)
       if (!d) return
-      const judged = judgeStop(d.answers, c)
+      const judged = judgeStop(d.answers, c, state.tools_this_turn.length > 0)
       const block = c.doneCheck ? judged.block : null
       if (block) pushedBackAt = count
       if (c.autoCompact && judged.wantsCompact) compactPending = true

package/hooks/dashboard.ts

@@ -95,8 +95,8 @@ export function dashboardHtml(rows: LogEntry[], opts: { now: number; sid?: strin
 @font-face { font-family: "Space Grotesk"; src: url("${FONTS}/SpaceGrotesk-Bold.woff2") format("woff2"); font-weight: 700; font-display: swap; }
 @font-face { font-family: "JetBrains Mono"; src: url("${FONTS}/JetBrainsMono-Regular.woff2") format("woff2"); font-weight: 400; font-display: swap; }
 :root {
-  --ground: #080b09; --surface: #111713; --panel: rgba(17, 23, 19, .9); --panel-hi: rgba(26, 36, 29, .94);
-  --paper: #f4f8f5; --muted: #a5b5a9; --faint: #829487; --line: #2c3930; --steel: #829487;
+  --ground: #0a0a0a; --surface: #131313; --panel: rgba(19, 19, 19, .9); --panel-hi: rgba(28, 28, 28, .94);
+  --paper: #f4f8f5; --muted: #a5b5a9; --faint: #829487; --line: #2e2e2e; --steel: #829487;
   --brand: #00ee22; --brand-hi: #39ff53; --link: #79ff98; --lavender: #b69cff;
   --ok: #56e887; --warn: #ffc857; --err: #ff737d; --info: #74c7ff;
   --ui: clamp(.875rem, .82rem + .15vw, 1rem);
@@ -110,7 +110,7 @@ html { background: var(--ground); scrollbar-color: var(--line) var(--ground); }
 body {
   min-height: 100vh; padding: clamp(26px, 4.5vh, 64px) clamp(22px, 6vw, 120px) 80px; color: var(--paper); font-family: var(--body);
   -webkit-font-smoothing: antialiased; background: var(--ground);
-  background-image: linear-gradient(rgba(130, 148, 135, .07) 1px, transparent 1px), linear-gradient(90deg, rgba(130, 148, 135, .07) 1px, transparent 1px);
+  background-image: linear-gradient(rgba(140, 140, 140, .07) 1px, transparent 1px), linear-gradient(90deg, rgba(140, 140, 140, .07) 1px, transparent 1px);
   background-size: 64px 64px;
 }
 ::selection { background: rgba(0, 238, 34, .3); color: var(--paper); }
@@ -160,7 +160,7 @@ section { margin-bottom: clamp(24px, 4vh, 44px); }
 .tbl { overflow: auto; border: 1px solid var(--line); scrollbar-width: thin; }
 table { width: 100%; border-collapse: collapse; }
 th { padding: 7px 14px; text-align: left; font: 600 .75rem var(--label); letter-spacing: .08em; text-transform: uppercase; color: var(--faint); border-bottom: 1px solid var(--line); background: var(--panel); white-space: nowrap; }
-td { padding: 6px 14px; border-bottom: 1px solid var(--line); color: var(--muted); font-size: .9375rem; line-height: 1.35; vertical-align: top; background: rgba(17, 23, 19, .82); font-variant-numeric: tabular-nums; }
+td { padding: 6px 14px; border-bottom: 1px solid var(--line); color: var(--muted); font-size: .9375rem; line-height: 1.35; vertical-align: top; background: rgba(19, 19, 19, .82); font-variant-numeric: tabular-nums; }
 tr:last-child td { border-bottom: 0; }
 tr:hover td { background: var(--panel-hi); }
 td:first-child, td:nth-child(2) { white-space: nowrap; }

package/hooks/policy.ts

@@ -24,6 +24,7 @@ export const DEFAULTS = {
   doneVerifiedMax: 0.3,
   doneAsksUserMax: 0.5,
   exfil: 0.7,
+  requested: 0.8,
   askJev: true,
   autoCompact: true,
   compactSwitched: 0.8,
@@ -75,15 +76,18 @@ export const score = (instructions: string, criteria: string[]): Question => ({
 // --- questions (rubrics from ten-levels-of-jev level 6) ---
 
 export const BLOCK_NOTICE =
-  'This block is final. Do not try to work around it with another command, another tool, a different path, ' +
-  'or an encoding that does the same thing. Stop and tell the user what was blocked and why.'
+  'Do not try to work around it with another command, another tool, a different path, or an encoding that does the ' +
+  'same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run exactly ' +
+  'this again: their reply then lets it through.'
 export const DONE_REASON =
   "You said this is done but nothing shows it was verified. Run the check, or say explicitly why it can't be verified."
 
 export const BASH_Q: Questions = {
   effect: choice('What does running `command` in `cwd` do to the machine?', {
     read_only: 'Lists, reads, searches, tests, builds into a scratch directory; nothing durable changes',
-    reversible: 'Changes files or state that git or a reinstall can restore: edits, installs, generated output',
+    reversible:
+      'Changes files or state that git, a reinstall or a rebuild can restore: edits, installs, uninstalls, deleting build ' +
+      'output or generated files, ordinary commits and pushes',
     irreversible:
       'Deletes or overwrites things with no way back: removing directories, force pushing, dropping data, rewriting history',
   }),
@@ -92,6 +96,11 @@ export const BASH_Q: Questions = {
     'rm -rf, drop, purge, force, reset --hard, truncate, overwriting real data',
     'Reading, listing, testing, installing, generating, or editing in place',
   ),
+  exfiltrates: noul(
+    'Does `command` send local files, secrets or environment values to an outside host?',
+    'curl or wget uploading a file or piping local data out, scp or rsync to a remote, posting keys, tokens or ~/.ssh, ~/.aws, .env contents',
+    'Downloads, git push to the project remote, package installs, API calls that send only the query, or nothing over the network',
+  ),
 }
 export const WRITE_Q: Questions = {
   kind: choice('What kind of file is `path`, given `content`?', {
@@ -122,11 +131,30 @@ export const POLICY_Q: Questions = {
   ),
 }
 /** A gate's questions plus the policy question, only when the user wrote policies. */
-export const withPolicyQ = (q: Questions, c: Config): Questions => (splitList(c.policies).length ? { ...q, ...POLICY_Q } : q)
+export const withPolicyQ = (q: Questions, c: Config, request = ''): Questions =>
+  ({ ...q, ...(splitList(c.policies).length ? POLICY_Q : {}), ...(request.trim() ? REQUESTED_Q : {}) })
 /** A gate's state plus the user's policies, only when there are some. */
-export const withPolicies = <T extends object>(state: T, c: Config): T | (T & { policies: string[] }) => {
+export const withPolicies = <T extends object>(state: T, c: Config, request = '', blockedBefore = ''): T => {
   const policies = splitList(c.policies)
-  return policies.length ? { ...state, policies } : state
+  return {
+    ...state,
+    ...(policies.length ? { policies } : {}),
+    ...(request.trim() ? { request: clip(request, 1500), ...(blockedBefore ? { blocked_before: blockedBefore } : {}) } : {}),
+  }
+}
+/** The call a gate denied, as the next turn's gates show it to Jev: a reply of "yes" then confirms this call. */
+export const callSummary = (tool: string, input: unknown): string => clip(`${tool} ${JSON.stringify(input)}`, 600)
+/** Asked only when there is a user request: does the user's own latest message ask for exactly this call? */
+export const REQUESTED_Q: Questions = {
+  requested: noul(
+    'Does `request`, the user\'s own latest message, ask for what this call does? When `blocked_before` is set, the ' +
+      'agent had just told the user that call was blocked and asked whether to run it. Without `blocked_before`, a bare ' +
+      'confirmation names nothing, so it asks for nothing.',
+    'The user named this action or its target (delete that file, force push, remove the co-author line, uninstall X), ' +
+      'or `blocked_before` is this same call and the user confirmed it (yes, do it, go ahead, run it)',
+    'The request is about something else, is vague, says no or wait, is a bare yes or ok with no `blocked_before`, or ' +
+      'the call differs from `blocked_before`; the agent chose this step on its own',
+  ),
 }
 /** The tier rubric: Jev's choice criteria, and the labels the built-in classifier picks from. */
 const TIER_CRITERIA: Record<Tier, string> = {
@@ -189,6 +217,47 @@ const nv = (a: Answers, k: string): number => {
 }
 const ch = (a: Answers, k: string): Choice => a[k] as Choice
 
+// --- the plain-read fast path: code, not Jev ---
+
+const READ_CMDS = new Set(['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'egrep', 'rg', 'pwd', 'echo', 'printf', 'which', 'file', 'stat',
+  'du', 'df', 'tree', 'sort', 'uniq', 'cut', 'tr', 'diff', 'date', 'whoami', 'uname', 'basename', 'dirname', 'realpath', 'cd',
+  'true', 'nl', 'column', 'sleep', 'jq', 'test', '[', 'type', 'readlink', 'md5', 'shasum', 'less', 'env', 'id', 'hostname'])
+const GIT_READS = new Set(['status', 'log', 'diff', 'show', 'rev-parse', 'ls-files', 'ls-tree', 'blame', 'grep', 'shortlog', 'describe',
+  'reflog', 'rev-list', 'cat-file', 'merge-base', 'worktree list', 'config --get', 'remote get-url'])
+const GIT_LISTS: Record<string, RegExp> = { branch: /^(-a|-r|-v|-vv|--list|--show-current|--all|--merged|--no-merged)$/, remote: /^(-v)$/, tag: /^(-l|--list)$/, stash: /^list$/ }
+
+/**
+ * True for a command that only reads, by code alone: every piece of a pipeline, `&&` chain or line is a known reader,
+ * with no substitution, redirect (other than to /dev/null), background job, heredoc or subshell. Quoted text is
+ * literal, so a `|` in a grep pattern is fine. Anything else, however harmless, goes to Jev.
+ */
+export function isPlainRead(command: string): boolean {
+  if (!command.trim() || /`|\$\(|<\(|>\(/.test(command)) return false
+  const s = command
+    .replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, 'Q') // quoted text is an argument, not syntax
+    .replace(/\s(?:[12]|&)?>\s*\/dev\/null(?=$|[\s;&|])|\s2>&1(?=$|[\s;&|])/g, ' ') // discarding output writes nothing
+  if (/[<>()]|(^|[^&])&($|[^&])|\\\n/.test(s)) return false
+  return s.split(/&&|\|\||;|\||\n/).every(piece => {
+    const w = piece.trim().split(/\s+/).filter(Boolean)
+    while (w[0] && /^[A-Za-z_]\w*=\S*$/.test(w[0])) w.shift() // VAR=value: sets a variable, runs nothing
+    const [cmd, ...args] = w
+    if (!cmd) return true
+    if (cmd === 'find') return !w.some(x => /^-(delete|exec|execdir|ok|okdir|fprint|fprintf|fls)$/.test(x))
+    if (cmd === 'git') {
+      while (args[0] === '--no-pager' || args[0] === '-C') args.splice(0, args[0] === '-C' ? 2 : 1)
+      const [sub, ...rest] = args
+      if (!sub) return false
+      if (GIT_READS.has(sub) || GIT_READS.has(`${sub} ${rest[0]}`)) return !w.some(x => /^--(output|ext-diff)/.test(x))
+      const ok = GIT_LISTS[sub]
+      return !!ok && rest.every(x => ok.test(x)) && (sub !== 'stash' || rest.length > 0) // a bare `git stash` stashes
+    }
+    if (cmd === 'env') return args.length === 0 // env with a command runs that command
+    return READ_CMDS.has(cmd)
+  })
+}
+/** Skip Jev for a plain read, unless the user's policies might forbid even reading something. */
+export const plainRead = (command: string, c: Config): boolean => !splitList(c.policies).length && isPlainRead(command)
+
 // --- judges ---
 
 /** A deny when Jev says the call breaks a listed policy at least at the gate's own threshold. */
@@ -197,16 +266,25 @@ const policyDeny = (a: Answers, threshold: number): Judged | null => {
   return p >= threshold ? { verdict: 'deny', reason: `breaks a listed policy (${f2(p)})` } : null
 }
 
+/** A Jev deny the user's own request asked for passes. Policy and path denies never reach here. */
+const unlessRequested = (j: Judged, a: Answers, c: Config): Judged => {
+  const r = nv(a, 'requested')
+  return j.verdict === 'deny' && r >= c.requested ? { verdict: null, reason: `${j.reason}; the user asked for it (${f2(r)})` } : j
+}
+
 export function gateBash(a: Answers, c: Config): Judged {
   const effect = ch(a, 'effect')
   const destructive = nv(a, 'destructive_intent')
   const policy = policyDeny(a, c.bashDestructive)
   if (policy) return policy
+  // destructive intent alone is most editing (deleting lines, uninstalling); it only tips an irreversible answer
   if (effect.choice === 'irreversible' && effect.confidence >= c.bashIrreversible)
-    return { verdict: 'deny', reason: `irreversible (${f2(effect.confidence)}): nothing would restore what this removes or overwrites` }
-  if (destructive >= c.bashDestructive)
-    return { verdict: 'deny', reason: `destructive intent (${f2(destructive)}): this command aims to wipe something` }
-  return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}` }
+    return unlessRequested({ verdict: 'deny', reason: `irreversible (${f2(effect.confidence)}): nothing would restore what this removes or overwrites` }, a, c)
+  if (effect.choice === 'irreversible' && destructive >= c.bashDestructive)
+    return unlessRequested({ verdict: 'deny', reason: `irreversible (${f2(effect.confidence)}) and destructive (${f2(destructive)}): this aims to wipe something with no way back` }, a, c)
+  const out = nv(a, 'exfiltrates')
+  if (out >= c.exfil) return unlessRequested({ verdict: 'deny', reason: `sends local data out (${f2(out)}): keep local files and credentials local` }, a, c)
+  return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}, exfil ${f2(out)}` }
 }
 
 export function gateWrite(a: Answers, c: Config): Judged {
@@ -215,9 +293,9 @@ export function gateWrite(a: Answers, c: Config): Judged {
   const policy = policyDeny(a, c.writeSecret)
   if (policy) return policy
   if (secret >= c.writeSecret)
-    return { verdict: 'deny', reason: `contains a credential (${f2(secret)}): put it in an ignored .env or a secret store` }
+    return unlessRequested({ verdict: 'deny', reason: `contains a credential (${f2(secret)}): put it in an ignored .env or a secret store` }, a, c)
   if (kind.choice === 'secrets' && kind.confidence >= c.writeSecretsKind)
-    return { verdict: 'deny', reason: `a secrets file (${f2(kind.confidence)}): keep credentials out of the repo` }
+    return unlessRequested({ verdict: 'deny', reason: `a secrets file (${f2(kind.confidence)}): keep credentials out of the repo` }, a, c)
   return { verdict: null, reason: `${kind.choice} (${f2(kind.confidence)}), secret ${f2(secret)}` }
 }
 
@@ -225,7 +303,7 @@ export function gateExfil(a: Answers, c: Config): Judged {
   const p = nv(a, 'exfiltrates')
   const policy = policyDeny(a, c.exfil)
   if (policy) return policy
-  if (p >= c.exfil) return { verdict: 'deny', reason: `sends local data out (${f2(p)}): keep local files and credentials local` }
+  if (p >= c.exfil) return unlessRequested({ verdict: 'deny', reason: `sends local data out (${f2(p)}): keep local files and credentials local` }, a, c)
   return { verdict: null, reason: `exfil ${f2(p)}` }
 }
 
@@ -239,8 +317,10 @@ export function screen(a: Answers, c: Config): { flagged: boolean; reason: strin
 }
 
 /** The done-check (DONE_REASON when done is claimed with no sign of a check or question) and the compact verdict. */
-export function judgeStop(a: Answers, c: Config): { block: string | null; wantsCompact: boolean } {
+/** `ranTools` false: the turn ran no tool, so there is nothing that could have been verified and nothing to block. */
+export function judgeStop(a: Answers, c: Config, ranTools = true): { block: string | null; wantsCompact: boolean } {
   const unverified =
+    ranTools &&
     nv(a, 'claimed_done') >= c.doneClaimed && nv(a, 'verified') < c.doneVerifiedMax && nv(a, 'asks_user') < c.doneAsksUserMax
   const wantsCompact = nv(a, 'switched_gears') >= c.compactSwitched && nv(a, 'at_boundary') >= c.compactBoundary
   return { block: unverified ? DONE_REASON : null, wantsCompact }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.3.2",
+  "version": "0.5.0",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",
@@ -126,6 +126,11 @@
         "description": "Deny when Jev rates a call as sending local data out at least this probably (0-1)",
         "default": 0.7
       },
+      "requested": {
+        "type": "number",
+        "description": "A gate's Jev deny passes when Jev rates your latest message as asking for exactly that call at least this probable (0-1). Policy and path denies always stand",
+        "default": 0.8
+      },
       "askJev": {
         "type": "boolean",
         "description": "Expose the ask_jev tool for quick judgments about repo files or text",