ohmyjev 0.4.0 → 0.5.0

package/README.md

@@ -58,11 +58,11 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 
 | Feature | What it does |
 |---|---|
-| **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more. A command Jev calls irreversible with less confidence is denied too when it also aims to wipe something (0.7). A reversible command always passes, so deleting lines, dropping a co-author trailer or uninstalling a plugin goes through. |
+| **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more, or when it sends local files or secrets to an outside host (0.7), such as `curl` uploading `~/.ssh`. A command Jev calls irreversible with less confidence is denied too when it also aims to wipe something (0.7). Reversible work always passes, so deleting lines, dropping a co-author trailer or uninstalling a plugin goes through. Plain reads like `ls`, `git status` or `grep` skip Jev entirely: plain code checks them, so they cost nothing and wait for nothing. |
 | **Write gate** | Denies writes outside the repo and `allowPaths`, and writes that contain a real credential. The repo means every worktree of the one the session started in, and every worktree of a repo the agent has moved into. The path check is plain code, not Jev, and it follows symlinks the way the OS does. |
 | **Exfil gate** | Denies a WebFetch or MCP call when Jev rates it 0.7 or more for sending your local data, files or credentials out. |
 | **Policies** | Every gate also checks the call against your own rules in the `policies` setting. |
-| **Your request** | Every gate also asks Jev whether your latest message asked for exactly this call. If it did (0.8), a gate's Jev deny lets the call through. So "delete the build folder" or "force push it" works, while the same command picked by the agent on its own is still denied. Policy and path denies always stand. |
+| **Your request** | Every gate also asks Jev whether your latest message asked for exactly this call. If it did (0.8), a gate's Jev deny lets the call through. So "delete the build folder" or "force push it" works, while the same command picked by the agent on its own is still denied. After a block, a plain "yes" works too: the gate shows Jev the call it just blocked next to your reply. Policy and path denies always stand. |
 | **Injection screen** | When output from Bash, WebFetch, an MCP tool, or a Read outside the repo has instructions aimed at the model, it adds a note telling the model to treat that output as data. |
 | **Done-check** | If the agent says it's done but nothing shows it ran a check, it blocks the stop once and tells the agent to verify. A turn that ran no tools is never blocked, since there was nothing to verify. |
 | **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
@@ -199,12 +199,13 @@ Claude gets the denial as the tool's result, with an instruction not to work aro
 ```
 ohmyjev blocked this: irreversible (0.95): nothing would restore what this removes or overwrites.
 Do not try to work around it with another command, another tool, a different path, or an encoding that does
-the same thing. Tell the user what was blocked and why. If they reply asking for exactly this, in words that
-name it, run it again: their request then lets it through.
+the same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run
+exactly this again: their reply then lets it through.
 ```
 
-So when the agent stops and tells you, answer with the action itself, for example "yes, delete ~/.agentmemory".
-A bare "yes" may not be enough, because the gate judges your latest message on its own.
+So when the agent stops and asks, answer "yes". The next gate shows Jev the blocked call next to your reply, so a
+yes confirms that call and nothing else. A yes with no block before it, "no", or a yes followed by a different
+command still gets denied.
 
 A write outside the repo gets a different message. It names the path and tells the model to ask you to add that
 directory to `allowPaths`, because that block is a setting, not a hazard.
@@ -335,7 +336,7 @@ a fixed size:
 
 | What asks | What it sends |
 |---|---|
-| Bash gate | The command (up to 16000 characters), the working directory, the tool call's description and your latest message (1500) |
+| Bash gate | The command (up to 16000 characters), the working directory, the tool call's description, your latest message (1500) and, right after a block, the blocked call (600). Plain reads send nothing |
 | Write gate | The file path and the new content (up to 16000 characters). Code denies writes outside the repo and `allowPaths` before it sends anything |
 | Exfil gate | The tool's name and its input (up to 4000 characters) |
 | Injection screen | The tool's output (up to 6000 characters), from Bash, WebFetch, MCP tools and Reads outside the repo |
@@ -386,6 +387,7 @@ git clone https://github.com/Novacon/ohmyjev && cd ohmyjev && bun install
 claude --plugin-dir "$PWD"                  # run your working copy, and it writes the API types to .claude-plugin/types
 omp -e ./adapters/omp.ts                    # or: pi -e ./adapters/pi.ts
 bun run test && bun run typecheck && claude plugin validate .
+bun tests/live.ts                           # 28 real commands against the live Jev, with the expected verdicts
 ```
 
 The decision logic lives in `hooks/policy.ts` and is pure, so you can test it with plain tables. `hooks/ohmyjev.ts`

package/adapters/omp.ts

@@ -4,7 +4,7 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead,
   OMJ_HELP, OMJ_OFF, OMJ_ON, settingsRows, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
@@ -254,6 +254,8 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     let pushedBackAt = -1
     let route: Route | undefined
     let liveRequest = ''
+    let lastBlocked = '' // the call a gate denied this turn
+    let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let classifiedPrompt: string | undefined
@@ -400,6 +402,8 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
       route = undefined
       liveRequest = ''
       userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
       classifiedPrompt = undefined
       status()
@@ -456,6 +460,8 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
       route = undefined
       liveRequest = ''
       userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
       classifiedPrompt = undefined
       pushedBackAt = -1
@@ -469,6 +475,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         const tool = event.toolName
         const input = object(event.input)
         if ((tool === 'bash' || tool === 'eval' || githubWrite(tool, input)) && c.bashGate) {
+          if (tool === 'bash' && plainRead(string(input, 'command'), c)) return // code says read-only, no Jev call
           const command = tool === 'eval'
             ? string(input, 'code')
             : tool === 'github'
@@ -485,11 +492,14 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
             description: clip(description, 300),
             ...(command.length > CLIP ? { truncated: true } : {}),
           }
-          const d = await session.decide('tool_call', tool, withPolicies(state, c, userRequest), withPolicyQ(BASH_Q, c, userRequest))
+          const d = await session.decide('tool_call', tool, withPolicies(state, c, userRequest, blockedBefore), withPolicyQ(BASH_Q, c, userRequest))
           if (!d) return
           const judged = gateBash(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
           return
         }
         if (WRITE_TOOLS[tool] && c.writeGate) {
@@ -508,25 +518,31 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
           const path = paths.join('; ')
           const d = await session.decide(
             'tool_call', tool,
-            withPolicies({ path, content: clip(writeContent(input), CLIP) }, c, userRequest),
+            withPolicies({ path, content: clip(writeContent(input), CLIP) }, c, userRequest, blockedBefore),
             withPolicyQ(WRITE_Q, c, userRequest),
           )
           if (!d) return
           const judged = gateWrite(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
           return
         }
         if (c.exfilGate && exfilTool(tool, input)) {
           const d = await session.decide(
             'tool_call', tool,
-            withPolicies({ tool, input: clip(safeJson(input), 4000) }, c, userRequest),
+            withPolicies({ tool, input: clip(safeJson(input), 4000) }, c, userRequest, blockedBefore),
             withPolicyQ(EXFIL_Q, c, userRequest),
           )
           if (!d) return
           const judged = gateExfil(d.answers, c)
           session.record(d, judged.verdict, judged.reason)
-          if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+          if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         }
       } catch {
         return
@@ -612,7 +628,11 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         if (ctx.agent.kind !== 'main' || !c.enabled) return
         userEffort = userThinking(ctx)
         const prompt = typeof rawEvent.prompt === 'string' ? rawEvent.prompt : ''
-        if (prompt.trim() && !/^\/\S+\s*$/.test(prompt.trim())) userRequest = prompt
+        if (prompt.trim() && !/^\/\S+\s*$/.test(prompt.trim())) {
+          userRequest = prompt
+          blockedBefore = lastBlocked
+          lastBlocked = ''
+        }
         if (!prompt.trim()) return
         if (classifiedPrompt !== prompt) {
           classifiedPrompt = prompt

package/adapters/pi.ts

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText,
+  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead,
   OMJ_HELP, OMJ_OFF, OMJ_ON, settingsRows, toggleArg,
   keepInstructions, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
@@ -257,6 +257,8 @@ export function createExtension(options: PiAdapterOptions = {}) {
     let pushedBackAt = -1
     let route: Route | undefined
     let liveRequest = ''
+    let lastBlocked = '' // the call a gate denied this turn
+    let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let userThinking: ThinkingLevel = 'medium'
@@ -291,6 +293,8 @@ export function createExtension(options: PiAdapterOptions = {}) {
       route = undefined
       liveRequest = ''
       userRequest = ''
+      lastBlocked = ''
+      blockedBefore = ''
       compactPending = false
     }
     const setThinking = (level: ThinkingLevel): void => {
@@ -405,7 +409,11 @@ export function createExtension(options: PiAdapterOptions = {}) {
 
     pi.on('before_agent_start', guarded<BeforeAgentStartEvent, void>(async (event, ctx) => {
       latestCtx = ctx
-      if (event.prompt.trim() && !/^\/\S+\s*$/.test(event.prompt.trim())) userRequest = event.prompt
+      if (event.prompt.trim() && !/^\/\S+\s*$/.test(event.prompt.trim())) {
+        userRequest = event.prompt
+        blockedBefore = lastBlocked
+        lastBlocked = ''
+      }
       if (!c.enabled) return
       const text = event.prompt
       if (!text.trim()) return
@@ -436,12 +444,16 @@ export function createExtension(options: PiAdapterOptions = {}) {
       const input = event.input
       if ((tool === 'bash' || tool === 'powershell') && c.bashGate) {
         const command = arg(input, 'command')
-        const state = withPolicies({ command: clip(command, CLIP), cwd: ctx.cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, userRequest)
+        if (plainRead(command, c)) return // ls, git status, grep: code says read-only, no Jev call
+        const state = withPolicies({ command: clip(command, CLIP), cwd: ctx.cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, userRequest, blockedBefore)
         const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, userRequest))
         if (!d) return
         const judged = gateBash(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         return
       }
       if ((tool === 'write' || tool === 'edit') && c.writeGate) {
@@ -451,24 +463,30 @@ export function createExtension(options: PiAdapterOptions = {}) {
           return { block: true, reason: pathDenyText(path) }
         }
         const content = tool === 'write' ? arg(input, 'content') : json(input.edits)
-        const d = await x.decide('tool.call', tool, withPolicies({ path, content: clip(content, CLIP) }, c, userRequest), withPolicyQ(WRITE_Q, c, userRequest))
+        const d = await x.decide('tool.call', tool, withPolicies({ path, content: clip(content, CLIP) }, c, userRequest, blockedBefore), withPolicyQ(WRITE_Q, c, userRequest))
         if (!d) return
         const judged = gateWrite(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
         return
       }
       if (tool.startsWith('mcp__') && c.exfilGate) {
         const d = await x.decide(
           'tool.call',
           tool,
-          withPolicies({ tool, input: clip(json(input), 4000) }, c, userRequest),
+          withPolicies({ tool, input: clip(json(input), 4000) }, c, userRequest, blockedBefore),
           withPolicyQ(EXFIL_Q, c, userRequest),
         )
         if (!d) return
         const judged = gateExfil(d.answers, c)
         x.record(d, judged.verdict, judged.reason)
-        if (judged.verdict === 'deny') return { block: true, reason: denyText(judged.reason) }
+        if (judged.verdict === 'deny') {
+          lastBlocked = callSummary(tool, input)
+          return { block: true, reason: denyText(judged.reason) }
+        }
       }
     }))
 

package/hooks/policy.ts

@@ -77,15 +77,17 @@ export const score = (instructions: string, criteria: string[]): Question => ({
 
 export const BLOCK_NOTICE =
   'Do not try to work around it with another command, another tool, a different path, or an encoding that does the ' +
-  'same thing. Tell the user what was blocked and why. If they reply asking for exactly this, in words that name it, ' +
-  'run it again: their request then lets it through.'
+  'same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run exactly ' +
+  'this again: their reply then lets it through.'
 export const DONE_REASON =
   "You said this is done but nothing shows it was verified. Run the check, or say explicitly why it can't be verified."
 
 export const BASH_Q: Questions = {
   effect: choice('What does running `command` in `cwd` do to the machine?', {
     read_only: 'Lists, reads, searches, tests, builds into a scratch directory; nothing durable changes',
-    reversible: 'Changes files or state that git or a reinstall can restore: edits, installs, generated output',
+    reversible:
+      'Changes files or state that git, a reinstall or a rebuild can restore: edits, installs, uninstalls, deleting build ' +
+      'output or generated files, ordinary commits and pushes',
     irreversible:
       'Deletes or overwrites things with no way back: removing directories, force pushing, dropping data, rewriting history',
   }),
@@ -94,6 +96,11 @@ export const BASH_Q: Questions = {
     'rm -rf, drop, purge, force, reset --hard, truncate, overwriting real data',
     'Reading, listing, testing, installing, generating, or editing in place',
   ),
+  exfiltrates: noul(
+    'Does `command` send local files, secrets or environment values to an outside host?',
+    'curl or wget uploading a file or piping local data out, scp or rsync to a remote, posting keys, tokens or ~/.ssh, ~/.aws, .env contents',
+    'Downloads, git push to the project remote, package installs, API calls that send only the query, or nothing over the network',
+  ),
 }
 export const WRITE_Q: Questions = {
   kind: choice('What kind of file is `path`, given `content`?', {
@@ -127,16 +134,26 @@ export const POLICY_Q: Questions = {
 export const withPolicyQ = (q: Questions, c: Config, request = ''): Questions =>
   ({ ...q, ...(splitList(c.policies).length ? POLICY_Q : {}), ...(request.trim() ? REQUESTED_Q : {}) })
 /** A gate's state plus the user's policies, only when there are some. */
-export const withPolicies = <T extends object>(state: T, c: Config, request = ''): T => {
+export const withPolicies = <T extends object>(state: T, c: Config, request = '', blockedBefore = ''): T => {
   const policies = splitList(c.policies)
-  return { ...state, ...(policies.length ? { policies } : {}), ...(request.trim() ? { request: clip(request, 1500) } : {}) }
+  return {
+    ...state,
+    ...(policies.length ? { policies } : {}),
+    ...(request.trim() ? { request: clip(request, 1500), ...(blockedBefore ? { blocked_before: blockedBefore } : {}) } : {}),
+  }
 }
+/** The call a gate denied, as the next turn's gates show it to Jev: a reply of "yes" then confirms this call. */
+export const callSummary = (tool: string, input: unknown): string => clip(`${tool} ${JSON.stringify(input)}`, 600)
 /** Asked only when there is a user request: does the user's own latest message ask for exactly this call? */
 export const REQUESTED_Q: Questions = {
   requested: noul(
-    'Does `request`, the user\'s own latest message, explicitly ask for what this call does?',
-    'The user named this action or its target: delete that file, force push, remove the co-author line, uninstall X',
-    'The request is about something else, is vague, or the agent chose this step on its own',
+    'Does `request`, the user\'s own latest message, ask for what this call does? When `blocked_before` is set, the ' +
+      'agent had just told the user that call was blocked and asked whether to run it. Without `blocked_before`, a bare ' +
+      'confirmation names nothing, so it asks for nothing.',
+    'The user named this action or its target (delete that file, force push, remove the co-author line, uninstall X), ' +
+      'or `blocked_before` is this same call and the user confirmed it (yes, do it, go ahead, run it)',
+    'The request is about something else, is vague, says no or wait, is a bare yes or ok with no `blocked_before`, or ' +
+      'the call differs from `blocked_before`; the agent chose this step on its own',
   ),
 }
 /** The tier rubric: Jev's choice criteria, and the labels the built-in classifier picks from. */
@@ -200,6 +217,47 @@ const nv = (a: Answers, k: string): number => {
 }
 const ch = (a: Answers, k: string): Choice => a[k] as Choice
 
+// --- the plain-read fast path: code, not Jev ---
+
+const READ_CMDS = new Set(['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'egrep', 'rg', 'pwd', 'echo', 'printf', 'which', 'file', 'stat',
+  'du', 'df', 'tree', 'sort', 'uniq', 'cut', 'tr', 'diff', 'date', 'whoami', 'uname', 'basename', 'dirname', 'realpath', 'cd',
+  'true', 'nl', 'column', 'sleep', 'jq', 'test', '[', 'type', 'readlink', 'md5', 'shasum', 'less', 'env', 'id', 'hostname'])
+const GIT_READS = new Set(['status', 'log', 'diff', 'show', 'rev-parse', 'ls-files', 'ls-tree', 'blame', 'grep', 'shortlog', 'describe',
+  'reflog', 'rev-list', 'cat-file', 'merge-base', 'worktree list', 'config --get', 'remote get-url'])
+const GIT_LISTS: Record<string, RegExp> = { branch: /^(-a|-r|-v|-vv|--list|--show-current|--all|--merged|--no-merged)$/, remote: /^(-v)$/, tag: /^(-l|--list)$/, stash: /^list$/ }
+
+/**
+ * True for a command that only reads, by code alone: every piece of a pipeline, `&&` chain or line is a known reader,
+ * with no substitution, redirect (other than to /dev/null), background job, heredoc or subshell. Quoted text is
+ * literal, so a `|` in a grep pattern is fine. Anything else, however harmless, goes to Jev.
+ */
+export function isPlainRead(command: string): boolean {
+  if (!command.trim() || /`|\$\(|<\(|>\(/.test(command)) return false
+  const s = command
+    .replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, 'Q') // quoted text is an argument, not syntax
+    .replace(/\s(?:[12]|&)?>\s*\/dev\/null(?=$|[\s;&|])|\s2>&1(?=$|[\s;&|])/g, ' ') // discarding output writes nothing
+  if (/[<>()]|(^|[^&])&($|[^&])|\\\n/.test(s)) return false
+  return s.split(/&&|\|\||;|\||\n/).every(piece => {
+    const w = piece.trim().split(/\s+/).filter(Boolean)
+    while (w[0] && /^[A-Za-z_]\w*=\S*$/.test(w[0])) w.shift() // VAR=value: sets a variable, runs nothing
+    const [cmd, ...args] = w
+    if (!cmd) return true
+    if (cmd === 'find') return !w.some(x => /^-(delete|exec|execdir|ok|okdir|fprint|fprintf|fls)$/.test(x))
+    if (cmd === 'git') {
+      while (args[0] === '--no-pager' || args[0] === '-C') args.splice(0, args[0] === '-C' ? 2 : 1)
+      const [sub, ...rest] = args
+      if (!sub) return false
+      if (GIT_READS.has(sub) || GIT_READS.has(`${sub} ${rest[0]}`)) return !w.some(x => /^--(output|ext-diff)/.test(x))
+      const ok = GIT_LISTS[sub]
+      return !!ok && rest.every(x => ok.test(x)) && (sub !== 'stash' || rest.length > 0) // a bare `git stash` stashes
+    }
+    if (cmd === 'env') return args.length === 0 // env with a command runs that command
+    return READ_CMDS.has(cmd)
+  })
+}
+/** Skip Jev for a plain read, unless the user's policies might forbid even reading something. */
+export const plainRead = (command: string, c: Config): boolean => !splitList(c.policies).length && isPlainRead(command)
+
 // --- judges ---
 
 /** A deny when Jev says the call breaks a listed policy at least at the gate's own threshold. */
@@ -224,7 +282,9 @@ export function gateBash(a: Answers, c: Config): Judged {
     return unlessRequested({ verdict: 'deny', reason: `irreversible (${f2(effect.confidence)}): nothing would restore what this removes or overwrites` }, a, c)
   if (effect.choice === 'irreversible' && destructive >= c.bashDestructive)
     return unlessRequested({ verdict: 'deny', reason: `irreversible (${f2(effect.confidence)}) and destructive (${f2(destructive)}): this aims to wipe something with no way back` }, a, c)
-  return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}` }
+  const out = nv(a, 'exfiltrates')
+  if (out >= c.exfil) return unlessRequested({ verdict: 'deny', reason: `sends local data out (${f2(out)}): keep local files and credentials local` }, a, c)
+  return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}, exfil ${f2(out)}` }
 }
 
 export function gateWrite(a: Answers, c: Config): Judged {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",