ohmyjev 0.6.1 → 0.8.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 lordknows13
+Copyright (c) 2026 Novacon
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -13,14 +13,14 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ```
 
 <p align="center">
-  Guardrails for Claude Code, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
+  Guardrails for Claude Code, Codex, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
   One mod that stops irreversible and data-leaking commands, even in bypass mode, and runs them when you say yes. It also flags prompt injection, pushes back on an unverified "done" and routes effort per turn.
 </p>
 
 <p align="center">
   <img alt="Claude Code 2.1.287+" src="https://img.shields.io/badge/Claude_Code-2.1.287%2B-d97757">
   <img alt="Decided by Jev" src="https://img.shields.io/badge/decided_by-Jev-101315">
-  <img alt="pi and omp" src="https://img.shields.io/badge/also_for-pi_·_omp-86a893">
+  <img alt="Codex, pi and omp" src="https://img.shields.io/badge/also_for-Codex_·_pi_·_omp-86a893">
   <a href="https://www.npmjs.com/package/ohmyjev"><img alt="npm" src="https://img.shields.io/npm/v/ohmyjev?color=de6145"></a>
   <img alt="MIT license" src="https://img.shields.io/badge/license-MIT-798186">
 </p>
@@ -30,7 +30,7 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
   <a href="#quick-start">Quick start</a> ·
   <a href="#what-you-get">What you get</a> ·
   <a href="#install">Install</a> ·
-  <a href="#pi-and-omp">pi and omp</a> ·
+  <a href="#codex-pi-and-omp">Codex, pi and omp</a> ·
   <a href="#using-it">Using it</a> ·
   <a href="#settings">Settings</a> ·
   <a href="#privacy">Privacy</a> ·
@@ -77,6 +77,7 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 | **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
 | **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
 | **`ask_jev`** | A tool the model can use to ask Jev about repo files or text without loading them into its own context. |
+| **`browse`** | A tool that does a web task in a headless browser, with Jev picking each click and field: a Google Flights search in about 6 seconds. Off until you turn on `browse`. |
 | **`/omj`** | This session's Jev calls, errors, cost, median latency and denies, and where the key comes from. It never prints the key. `/omj config` lists and changes settings. `/omj stats` opens a dashboard of every session in your browser. `/omj off` and `/omj on` switch ohmyjev for the session. `/ohmyjev` is the same command. |
 
 ### How a tool call goes through it
@@ -144,11 +145,29 @@ key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0
 If it says `key: none`, ohmyjev can't see a key. In that case every gate stays open, the router falls back to Claude
 Code's built-in classifier (up only), and the status under the prompt shows `jev ⚠ no key`.
 
-## pi and omp
+## Codex, pi and omp
 
-The same checks run in [pi](https://pi.dev) and [omp](https://github.com/can1357/oh-my-pi) as a native extension.
-They share the decision logic and the key lookup (`TYPESAFE_API_KEY`, then `OPENROUTER_API_KEY`) with the Claude Code
-plugin, and write to the same `~/.ohmyjev` logs, so `/omj` and the statusline segment work the same way.
+The same checks run in [Codex](https://developers.openai.com/codex) as a plugin with hooks, and in [pi](https://pi.dev)
+and [omp](https://github.com/can1357/oh-my-pi) as a native extension. They share the decision logic and the key lookup
+(`TYPESAFE_API_KEY`, then `OPENROUTER_API_KEY`) with the Claude Code plugin, and write to the same `~/.ohmyjev` logs, so
+`/omj stats` in any of them shows every session.
+
+### Codex
+
+```bash
+codex plugin marketplace add Novacon/ohmyjev
+codex plugin add ohmyjev@ohmyjev
+```
+
+Then start Codex and run `/hooks` once: Codex skips a plugin's hooks until you trust them. ohmyjev needs Node on your
+`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, screens their
+output, and runs the done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
+a tool, so there is no router, no `ask_jev` and no `/omj` command. Put settings in `~/.codex/ohmyjev.json`, using the
+names in [Settings](#settings):
+
+```json
+{ "requested": 0.9, "policies": "never touch the prod cluster" }
+```
 
 ### omp
 
@@ -184,18 +203,19 @@ pi has no settings screen for extensions, so put yours under an `ohmyjev` key in
 
 ### What differs
 
-| | Claude Code | omp | pi |
-|---|---|---|---|
-| Bash gate | Bash | `bash`, `eval`, and `github` pushes and PRs | `bash`, `powershell` |
-| Write gate | Write, Edit, NotebookEdit | `write`, `edit` (patches and renames included), `ast_edit` | `write`, `edit` |
-| Exfil gate | WebFetch, MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
-| Injection screen | Bash, WebFetch, MCP, Reads outside the repo | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
-| Done-check | ✓ | ✓ | ✓ |
-| Router effort | ✓ | ✓ (left alone while you're on `auto`) | ✓ |
-| Router subagent model | general-purpose subagents | subagents on the default `task` role | none: pi has no subagents |
-| Router without a key | Claude Code's built-in classifier, up only | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
-| Decision lines | in the transcript | notifications | notifications |
-| Status | under the prompt | in the footer | in the footer |
+| | Claude Code | Codex | omp | pi |
+|---|---|---|---|---|
+| Bash gate | Bash | Bash | `bash`, `eval`, and `github` pushes and PRs | `bash`, `powershell` |
+| Write gate | Write, Edit, NotebookEdit | `apply_patch` | `write`, `edit` (patches and renames included), `ast_edit` | `write`, `edit` |
+| Exfil gate | WebFetch, MCP tools | MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
+| Injection screen | Bash, WebFetch, MCP, Reads outside the repo | Bash, MCP | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
+| Done-check | ✓ | ✓ | ✓ | ✓ |
+| Router effort | ✓ | none: hooks can't set it | ✓ (left alone while you're on `auto`) | ✓ |
+| Router subagent model | general-purpose subagents | none | subagents on the default `task` role | none: pi has no subagents |
+| Router without a key | Claude Code's built-in classifier, up only | none | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
+| `/omj`, `ask_jev`, `browse` | ✓ | none: hooks can't add commands or tools | ✓ | ✓ |
+| Decision lines | in the transcript | the log only | notifications | notifications |
+| Status | under the prompt | none | in the footer | in the footer |
 
 ## Using it
 
@@ -256,6 +276,31 @@ The model can call this tool on its own when it needs a judgment about files wit
 Jev reads the files, not the model. ohmyjev only sends files that are inside the repo, up to 8000 characters each and
 80000 in total.
 
+### `browse`
+
+Turn it on with `/omj config browse on`, or `browse` in the settings. The model then has a `browse` tool for tasks on a
+website: give it a starting URL, one narrow goal, and the text it may type.
+
+```json
+{
+  "url": "https://www.google.com/travel/flights?hl=en",
+  "goal": "Find one-way flights from Zurich to London on November 20, 2026. Stop when flight options show.",
+  "values": ["Zurich", "London", "Nov 20, 2026"]
+}
+```
+
+Each step, Jev reads the page's controls and picks one action and its target in a single request, and when a field
+needs text it picks the right entry from `values`. That run took 11 steps and 5.5 seconds: one-way, both cities, the
+date, search. The tool returns where it ended, the steps and the page's visible text, and that text goes through the
+injection screen like any tool output. The exfil gate checks the goal first, so a goal that would carry your files to a
+website is denied before the browser opens.
+
+It is [browser-use/jev-ultrafast](https://github.com/browser-use/jev-ultrafast) (MIT), pinned to one commit, run through
+[uv](https://docs.astral.sh/uv), so install uv once. It starts its own headless Chrome, Chromium, Brave or Edge with
+a profile in `~/.ohmyjev/browser`, signed in to nothing, and closes it after the task. Set `CHROME_PATH` to choose the
+browser. With `OPENROUTER_API_KEY` or `TEXT_MODEL_API_KEY` set, a small text model writes field text instead of picking
+from `values`. Use WebFetch for a page the model only needs to read.
+
 ### In the transcript
 
 Each routing decision shows up as a dim line in the transcript. The model never sees these lines. First what Jev
@@ -334,6 +379,7 @@ one for the session. To keep a change, run `/plugin configure ohmyjev@ohmyjev` i
 | `routeWithoutKey` | on | With no key, routes with Claude Code's built-in classifier instead. It has no confidence, so it only routes up. |
 | `autoCompact` | on | Compacts when the task changes. `compactMinPercent` (40) sets how full the context has to be first. |
 | `askJev` | on | Gives the model the `ask_jev` tool. |
+| `browse` | off | Gives the model the `browse` tool. Needs uv and a Chromium-based browser. |
 | `policies` | empty | Your own rules, separated by `;`. |
 | `allowPaths` | `~/.claude;$TMPDIR;/tmp` | Places outside the repo where writes are allowed. ohmyjev ignores any entry with `..` in it. You don't need it for a sibling worktree or another git repo the agent `cd`s into: those count as the repo. |
 | `fastModel`, `balancedModel`, `deepModel` | `claude-haiku-5-5`, `claude-sonnet-5-5`, `claude-opus-5-5` | The model id for each router tier. |
@@ -365,6 +411,7 @@ a fixed size:
 | Done-check | The current request (600), up to five earlier requests (200 each), up to 20 of this turn's tool calls with their input (200 each) and outcome, and Claude's last message (1500) |
 | Router | The request (up to 1500 characters) |
 | `ask_jev` | The model's question, any text it passes (up to 20000 characters) and the repo files it names (8000 each, 80000 in total). It never sends files outside the repo |
+| `browse` | The goal and URL to the exfil gate; then, each step, the page's controls and visible text (6000) and the goal to Jev, and the page's text to the injection screen. The websites see the browser like any visitor |
 
 The write and exfil gates also send your latest message (1500), for the request check. When you've set `policies`,
 every gate sends those too. Turning a feature off stops its calls.
@@ -379,6 +426,9 @@ have set up, through pi's own provider. Logs and session files stay in `~/.ohmyj
 claude plugin update ohmyjev@ohmyjev      # then restart Claude Code
 claude plugin uninstall ohmyjev@ohmyjev
 
+codex plugin marketplace upgrade ohmyjev  # Codex; then trust the changed hooks in /hooks
+codex plugin remove ohmyjev@ohmyjev
+
 omp plugin upgrade ohmyjev                # omp; restart the session
 omp plugin uninstall ohmyjev
 
@@ -418,4 +468,5 @@ The design and plans are in [`docs/superpowers`](docs/superpowers).
 
 ## Credits
 
-The question rubrics come from [disler/ten-levels-of-jev](https://github.com/disler/ten-levels-of-jev). MIT license.
+The question rubrics come from [disler/ten-levels-of-jev](https://github.com/disler/ten-levels-of-jev). `browse` runs
+[browser-use/jev-ultrafast](https://github.com/browser-use/jev-ultrafast). Both MIT.

package/adapters/codex.ts

@@ -0,0 +1,163 @@
+/**
+ * ohmyjev for Codex: one command hook, run once per event (codex/hooks.json). Each run is a fresh process, so what
+ * must outlive it (the user's latest request, the call blocked last turn, this turn's tools) sits in
+ * ~/.ohmyjev/codex/<session>.json. Same decisions as the other hosts (hooks/policy.ts); every failure prints nothing,
+ * and nothing lets the call through. Codex hooks can't change the model or add tools, so there is no router or ask_jev.
+ * Built to codex/ohmyjev.mjs with `bun run build:codex`, since Codex runs it with plain node.
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import {
+  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, callSummary, clip, denyText, gateBash, gateExfil, gateWrite,
+  judgeStop, pathDenyText, plainRead, readConfig, sanitizeSid, screen, withPolicies, withPolicyQ, type Config,
+} from '../hooks/policy.ts'
+import { Session, keyOf, pathAllowed, repoRoot, type Env, type Fetch } from './shared.ts'
+
+const CLIP = 16000
+type Tool = { tool: string; input: string; outcome: 'ok' | 'failed' }
+type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number }
+const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1 }
+type Input = Record<string, unknown>
+const str = (o: Input, k: string): string => (typeof o[k] === 'string' ? (o[k] as string) : '')
+const obj = (v: unknown): Input => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Input) : {})
+
+/** Settings: ~/.codex/ohmyjev.json, a flat object of the setting names in the README. */
+async function config(env: Env): Promise<Config> {
+  const text = await readFile(`${env.HOME ?? ''}/.codex/ohmyjev.json`, 'utf8').catch(() => '{}')
+  try {
+    return readConfig(obj(JSON.parse(text)))
+  } catch {
+    return readConfig({})
+  }
+}
+
+const statePath = (env: Env, sid: string) => `${env.HOME ?? ''}/.ohmyjev/codex/${sanitizeSid(sid)}.json`
+async function load(env: Env, sid: string): Promise<State> {
+  const text = await readFile(statePath(env, sid), 'utf8').catch(() => '')
+  try {
+    return { ...EMPTY, ...(JSON.parse(text) as Partial<State>) }
+  } catch {
+    return { ...EMPTY }
+  }
+}
+// ponytail: last write wins; two hooks finishing at once can drop one tool from this turn's list (done-check input only)
+async function save(env: Env, sid: string, st: State): Promise<void> {
+  await mkdir(`${env.HOME ?? ''}/.ohmyjev/codex`, { recursive: true, mode: 0o700 }).catch(() => undefined)
+  await writeFile(statePath(env, sid), JSON.stringify(st), { mode: 0o600 }).catch(() => undefined)
+}
+
+const deny = (reason: string) => ({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } })
+
+/** One hook event in, Codex's JSON answer out; undefined means no opinion. */
+export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise<object | undefined> {
+  const c = await config(env)
+  const event = str(input, 'hook_event_name')
+  const sid = str(input, 'session_id') || 'codex'
+  const cwd = str(input, 'cwd') || process.cwd()
+  if (!c.enabled) return undefined
+
+  if (event === 'SessionStart')
+    return keyOf(c, env) ? undefined : { systemMessage: 'ohmyjev: no Jev key, so every call passes through. Set TYPESAFE_API_KEY in the shell that starts Codex.' }
+
+  const st = await load(env, sid)
+  if (event === 'UserPromptSubmit') {
+    const prompt = str(input, 'prompt')
+    if (!prompt.trim() || /^\/\S+\s*$/.test(prompt.trim())) return undefined
+    if (st.request) st.previous = [...st.previous, clip(st.request, 200)].slice(-5)
+    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [] })
+    await save(env, sid, st)
+    return undefined
+  }
+
+  const x = new Session(c, env, sid, undefined, fetchImpl)
+  const tool = str(input, 'tool_name')
+  const toolInput = obj(input.tool_input)
+
+  if (event === 'PreToolUse') {
+    const blocked = async (j: { verdict: unknown; reason: string }) => {
+      if (j.verdict !== 'deny') return undefined
+      st.lastBlocked = callSummary(tool, toolInput)
+      await save(env, sid, st)
+      return deny(denyText(j.reason))
+    }
+    if (tool === 'Bash' && c.bashGate) {
+      const command = str(toolInput, 'command')
+      if (plainRead(command, c)) return undefined
+      const state = withPolicies({ command: clip(command, CLIP), cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateBash(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    if (tool === 'apply_patch' && c.writeGate) {
+      const patch = str(toolInput, 'command')
+      const root = await repoRoot(cwd)
+      for (const path of applyPatchPaths(patch))
+        if (!(await pathAllowed(path, cwd, root, c, env))) {
+          x.denyByCode(tool, `${path} is outside the repo and allowPaths`)
+          return deny(pathDenyText(path))
+        }
+      const state = withPolicies({ path: applyPatchPaths(patch).join('; '), content: clip(patch, CLIP) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(WRITE_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateWrite(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    if (tool.startsWith('mcp__') && c.exfilGate) {
+      const state = withPolicies({ tool, input: clip(JSON.stringify(toolInput), 4000) }, c, st.request, st.blockedBefore)
+      const d = await x.decide('tool.call', tool, state, withPolicyQ(EXFIL_Q, c, st.request))
+      if (!d) return undefined
+      const j = gateExfil(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      return blocked(j)
+    }
+    return undefined
+  }
+
+  if (event === 'PostToolUse') {
+    const response = input.tool_response
+    const code = obj(response).exit_code ?? obj(response).exitCode
+    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok' } as Tool].slice(-20)
+    await save(env, sid, st)
+    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__'))) return undefined
+    const text = typeof response === 'string' ? response : JSON.stringify(response ?? '')
+    if (!text.trim()) return undefined
+    const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
+    if (!d) return undefined
+    const s = screen(d.answers, c)
+    x.record(d, s.flagged ? 'flag' : null, s.reason)
+    return s.flagged ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: s.note } } : undefined
+  }
+
+  if (event === 'Stop') {
+    if (!c.doneCheck || input.stop_hook_active === true || st.pushedBackAt === st.count) return undefined
+    const state = {
+      current_request: clip(st.request, 600),
+      previous_requests: st.previous,
+      tools_this_turn: st.tools,
+      last_assistant_message: clip(str(input, 'last_assistant_message'), 1500),
+    }
+    const d = await x.decide('Stop', '', state, STOP_Q)
+    if (!d) return undefined
+    const j = judgeStop(d.answers, c, st.tools.length > 0)
+    x.record(d, j.block ? 'block' : null, j.block ?? 'stop ok')
+    if (!j.block) return undefined
+    st.pushedBackAt = st.count
+    await save(env, sid, st)
+    return { decision: 'block', reason: j.block }
+  }
+  return undefined
+}
+
+/** The hook command: one JSON event on stdin, the answer on stdout. Any failure prints nothing, so Codex goes on. */
+export async function main(): Promise<void> {
+  try {
+    let text = ''
+    for await (const chunk of process.stdin) text += chunk
+    const out = await handle(obj(JSON.parse(text)), process.env)
+    if (out) process.stdout.write(JSON.stringify(out))
+  } catch {
+    // ohmyjev's own bug: no opinion
+  }
+}

package/adapters/omp.ts

@@ -4,13 +4,13 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand,
-  OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand, applyPatchPaths,
+  BROWSE_DESCRIPTION, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, Session, answerAsk, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, Session, answerAsk, runBrowse, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -150,15 +150,6 @@ const exfilTool = (tool: string, input: RecordOfUnknown): boolean => urlRead(too
 const githubWrite = (tool: string, input: RecordOfUnknown): boolean =>
   tool === 'github' && GITHUB_READONLY_OPS[string(input, 'op')] !== true
 
-function applyPatchPaths(patch: string): string[] {
-  const paths: string[] = []
-  for (const line of patch.split('\n')) {
-    const match = /^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/.exec(line.trim())
-    if (match?.[1]) paths.push(match[1])
-  }
-  return paths
-}
-
 function writePaths(tool: string, input: RecordOfUnknown): string[] {
   const paths = Array.isArray(input.paths) ? input.paths.filter((p): p is string => typeof p === 'string' && p !== '') : []
   for (const key of ['path', 'file_path', 'notebook_path']) {
@@ -260,6 +251,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     let compactPending = false
     let classifiedPrompt: string | undefined
     let askRegistered = false
+    let browseRegistered = false
     let sessionGeneration = 0
     let userEffort: string | undefined
     const routedThinkingEntries = new Set<string>()
@@ -432,6 +424,35 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         })
         askRegistered = true
       }
+      if (c.browse && !browseRegistered) {
+        const t = pi.typebox.Type
+        pi.registerTool({
+          name: 'browse',
+          label: 'Browse',
+          description: BROWSE_DESCRIPTION,
+          parameters: t.Object({
+            url: t.String({ description: 'Where to start, an http(s) URL' }),
+            goal: t.String({ description: 'One narrow goal, and when to stop' }),
+            values: t.Optional(t.Array(t.String(), { description: 'Exact text the task may type; Jev puts each into the field that needs it' })),
+          }),
+          approval: 'exec',
+          async execute(_id, params, _signal, _update, toolCtx) {
+            try {
+              touch(toolCtx)
+              if (!session) return { content: [{ type: 'text', text: JSON.stringify({ error: 'jev session unavailable' }) }] }
+              const r = await runBrowse(session, params, userRequest, blockedBefore)
+              if ('deny' in r) {
+                lastBlocked = callSummary('browse', params)
+                return { content: [{ type: 'text', text: r.deny }], details: {}, isError: true }
+              }
+              return { content: [{ type: 'text', text: r.text }], details: {} }
+            } catch {
+              return { content: [{ type: 'text', text: JSON.stringify({ error: 'browse failed' }) }], details: {} }
+            }
+          },
+        })
+        browseRegistered = true
+      }
     }
 
     const reinitialize = async (ctx: HostContext): Promise<void> => {

package/adapters/pi.ts

@@ -2,12 +2,12 @@ import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
   TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand,
-  OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
+  BROWSE_DESCRIPTION, BROWSE_SCHEMA, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, runBrowse, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -354,6 +354,29 @@ export function createExtension(options: PiAdapterOptions = {}) {
       })
       askRegistered = true
     }
+    let browseRegistered = false
+    const registerBrowse = (): void => {
+      if (browseRegistered || !c.browse) return
+      pi.registerTool({
+        name: 'browse',
+        label: 'Browse',
+        description: BROWSE_DESCRIPTION,
+        parameters: BROWSE_SCHEMA,
+        async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+          try {
+            const r = await runBrowse(await ensureSession(ctx), params, userRequest, blockedBefore)
+            if ('deny' in r) {
+              lastBlocked = callSummary('browse', params)
+              return { content: [{ type: 'text', text: r.deny }], details: undefined, isError: true }
+            }
+            return { content: [{ type: 'text', text: r.text }], details: undefined }
+          } catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'browse failed' }) }], details: undefined }
+          }
+        },
+      })
+      browseRegistered = true
+    }
 
     /** /omj and /ohmyjev: the report, `settings`, or `on`/`off` for this session (the enabled setting is the default). */
     const command = async (args: string, ctx: PiContext): Promise<void> => {
@@ -389,6 +412,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
       userThinking = pi.getThinkingLevel()
       const x = await ensureSession(ctx)
       registerAsk()
+      registerBrowse()
       const key = keyOf(c, env)
       say(
         ctx,

package/adapters/shared.ts

@@ -8,7 +8,7 @@ import { appendFile, chmod, lstat, mkdir, readFile, readdir, realpath, writeFile
 import { dashboardHtml } from '../hooks/dashboard.ts'
 import { ENDPOINTS, JevError, parseReply, pickKey, type Key } from '../hooks/jev.ts'
 import {
-  DASHBOARD, EMPTY_SESSION, absolute, buildQuestion, clip, expandRoot, hostPath, isUnder, normalize, parseLog, parseWorktrees, rawAbsolute, sanitizeSid,
+  BROWSE_TIMEOUT_MS, DASHBOARD, EMPTY_SESSION, EXFIL_Q, SCREEN_Q, browseCommand, browseReply, denyText, gateExfil, screen, withPolicies, withPolicyQ, absolute, buildQuestion, clip, expandRoot, hostPath, isUnder, normalize, parseLog, parseWorktrees, rawAbsolute, sanitizeSid,
   splitList, statusText, summarize, type Answers, type Config, type LogEntry, type Questions, type SessionState, type Verdict,
 } from '../hooks/policy.ts'
 
@@ -288,3 +288,48 @@ export async function answerAsk(x: Session, input: Record<string, unknown>, cwd:
   x.record(d, null, 'asked')
   return JSON.stringify(d.answers.answer)
 }
+
+// --- browse: jev-ultrafast in the user's Chrome ---
+
+/** Runs a process to completion: its stdout and stderr, whatever the exit. Tests pass a fake. */
+export type Runner = (argv: string[], env: Record<string, string>, timeoutMs: number) => Promise<{ stdout: string; stderr: string }>
+const execRunner: Runner = (argv, env, timeoutMs) => {
+  const { promise, resolve } = Promise.withResolvers<{ stdout: string; stderr: string }>()
+  execFile(argv[0]!, argv.slice(1), { env: { ...process.env, ...env }, timeout: timeoutMs, maxBuffer: 4 << 20 }, (err, stdout, stderr) =>
+    resolve({ stdout: String(stdout ?? ''), stderr: String(stderr ?? '') || (err ? String(err) : '') }))
+  return promise
+}
+
+/**
+ * browse for pi and omp: the exfil gate on the call (the user's request can lift it), jev-ultrafast, then the
+ * injection screen on what came back. The text for the model, or a deny.
+ */
+export async function runBrowse(
+  x: Session,
+  input: Record<string, unknown>,
+  request = '',
+  blockedBefore = '',
+  run: Runner = execRunner,
+): Promise<{ text: string } | { deny: string }> {
+  const c = x.c
+  if (!c.browse) return { text: JSON.stringify({ error: 'browse is off: /omj config browse on' }) }
+  if (c.enabled && c.exfilGate) {
+    const state = withPolicies({ tool: 'browse', input: clip(JSON.stringify(input), 4000) }, c, request, blockedBefore)
+    const d = await x.decide('tool.call', 'browse', state, withPolicyQ(EXFIL_Q, c, request))
+    if (d) {
+      const j = gateExfil(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      if (j.verdict === 'deny') return { deny: denyText(j.reason) }
+    }
+  }
+  const cmd = browseCommand(input, c, x.env)
+  if (typeof cmd === 'string') return { text: JSON.stringify({ error: cmd }) }
+  const r = await run(cmd.argv, cmd.env, BROWSE_TIMEOUT_MS)
+  const text = browseReply(r.stdout, r.stderr)
+  if (!c.enabled || !c.injectionScreen) return { text }
+  const d = await x.decide('tool.result', 'browse', { tool: 'browse', content: clip(text, 6000) }, SCREEN_Q)
+  if (!d) return { text }
+  const s = screen(d.answers, c)
+  x.record(d, s.flagged ? 'flag' : null, s.reason)
+  return { text: s.flagged ? `${text}\n${s.note}` : text }
+}

package/hooks/policy.ts

@@ -26,6 +26,7 @@ export const DEFAULTS = {
   exfil: 0.7,
   requested: 0.8,
   askJev: true,
+  browse: false,
   autoCompact: true,
   compactSwitched: 0.8,
   compactBoundary: 0.6,
@@ -480,6 +481,16 @@ export function hostPath(p: string): string | null {
 export const parseWorktrees = (porcelain: string): string[] =>
   porcelain.split('\n').filter(l => l.startsWith('worktree ')).map(l => l.slice('worktree '.length).trim()).filter(Boolean)
 
+/** Every file an apply_patch patch adds, updates, deletes or moves to (omp and Codex edits). */
+export function applyPatchPaths(patch: string): string[] {
+  const paths: string[] = []
+  for (const line of patch.split('\n')) {
+    const match = /^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/.exec(line.trim())
+    if (match?.[1]) paths.push(match[1])
+  }
+  return paths
+}
+
 export const isUnder = (target: string, root: string): boolean =>
   target === root || target.startsWith(root.replace(/\/+$/, '') + '/')
 
@@ -582,3 +593,133 @@ export function summarize(log: string): string {
     ...denies.slice(-5).map(r => `  ${r.tool || r.event}: ${r.reason ?? ''}`),
   ].join('\n')
 }
+
+// --- browse: jev-ultrafast (github.com/browser-use/jev-ultrafast, MIT) drives Chrome, Jev picks each step ---
+
+export const JEV_ULTRAFAST = 'git+https://github.com/browser-use/jev-ultrafast@1231850a0bf1a0c0341fe408ef1668dbbfdfac46'
+export const BROWSE_TIMEOUT_MS = 180_000
+export const BROWSE_DESCRIPTION =
+  'Do a task in a real browser tab, fast: Jev picks each click, field and option from the page\'s controls (about one ' +
+  'second per step). Give a starting URL and one narrow goal, like "find one-way flights Zurich to London on Sept 20, ' +
+  'stop when results show" or "open the install section of these docs", with the text to type in `values`. Returns ' +
+  'where it ended, the steps taken and the visible text. Runs in its own headless browser, signed in to nothing. Use WebFetch for a page you only need to read.'
+export const BROWSE_SCHEMA = {
+  type: 'object',
+  properties: {
+    url: { type: 'string', description: 'Where to start, an http(s) URL' },
+    goal: { type: 'string', description: 'One narrow goal, and when to stop' },
+    values: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Exact text the task may type: names, dates, search terms ("Zurich", "London", "Sep 20, 2026"). Jev puts each into the field that needs it',
+    },
+  },
+  required: ['url', 'goal'],
+} as const
+
+/** Runs one jev-ultrafast Agent and prints one JSON line: where it ended, its steps, the visible text; or an error. */
+const BROWSE_PY = `
+import glob, json, os, shutil, subprocess, sys, tempfile, time
+
+def chromium():
+    if os.environ.get("CHROME_PATH"): return os.environ["CHROME_PATH"]
+    for app in ["Google Chrome", "Chromium", "Brave Browser", "Microsoft Edge"]:
+        p = f"/Applications/{app}.app/Contents/MacOS/{app}"
+        if os.path.exists(p): return p
+    for name in ["google-chrome", "chromium", "chromium-browser", "brave-browser", "microsoft-edge"]:
+        if shutil.which(name): return shutil.which(name)
+    home = os.path.expanduser("~")
+    found = sorted(glob.glob(home + "/Library/Caches/ms-playwright/chromium-*/chrome-mac*/*.app/Contents/MacOS/*")
+        + glob.glob(home + "/.cache/ms-playwright/chromium-*/chrome-linux*/chrome")
+        + glob.glob(home + "/.omp/puppeteer/chrome/*/*/*.app/Contents/MacOS/*"))
+    return found[-1] if found else None
+
+def headless():
+    exe = chromium()
+    if not exe: raise RuntimeError("no Chrome, Chromium, Brave or Edge found; install one or set CHROME_PATH")
+    profile = os.path.expanduser("~/.ohmyjev/browser")
+    os.makedirs(profile, exist_ok=True)
+    port_file = os.path.join(profile, "DevToolsActivePort")
+    if os.path.exists(port_file): os.remove(port_file)
+    proc = subprocess.Popen([exe, "--headless=new", "--remote-debugging-port=0", "--user-data-dir=" + profile,
+        "--no-first-run", "--no-default-browser-check", "--window-size=1120,780", "about:blank"],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    for _ in range(150):
+        if os.path.exists(port_file) and open(port_file).read().strip(): break
+        time.sleep(0.05)
+    else:
+        proc.kill(); raise RuntimeError("the headless browser did not start: " + exe)
+    os.environ["BU_CDP_URL"] = "http://127.0.0.1:" + open(port_file).read().split()[0]
+    return proc
+
+def pick_value(context):
+    # No text model: Jev picks, from the values the coding agent gave, the one this field needs.
+    from jev_ultrafast.model import post_json
+    values = json.loads(os.environ.get("OMJ_BROWSE_VALUES") or "[]")
+    criteria = {f"v{i}": v for i, v in enumerate(values)}
+    criteria["none"] = "None of these is what this field needs"
+    started = time.time()
+    body = {"model": os.environ.get("TYPESAFE_MODEL", "jev-latest"), "state": context, "questions": {"value": {
+        "type": "choice", "instructions": "Which value should be typed into \`field\` to make progress on \`goal\`?", "criteria": criteria}}}
+    answer = post_json("https://api.typesafe.ai/v1/systemone", os.environ["TYPESAFE_API_KEY"], body)["answers"]["value"]["choice"]
+    if answer not in criteria or answer == "none":
+        raise ValueError("no given value fits the field " + json.dumps(context["field"].get("label")) + "; pass the text it needs in values")
+    return criteria[answer], {"model": "jev (picked from values)", "latency_ms": round((time.time() - started) * 1000), "usage": {}}
+
+proc = None
+try:
+    if not (os.environ.get("BU_CDP_URL") or os.environ.get("BU_CDP_WS")): proc = headless()
+    from jev_ultrafast import Agent
+    import jev_ultrafast.agent
+    if not os.environ.get("TEXT_MODEL_API_KEY"): jev_ultrafast.agent.field_text = pick_value
+    with Agent(sys.argv[1], sys.argv[2]) as agent:
+        for _ in agent.run():
+            pass
+        s = agent.snapshot()
+except Exception as e:
+    print(json.dumps({"error": str(e)[:500]})); sys.exit(0)
+finally:
+    if proc: proc.terminate()
+p = s["page"]
+steps = [h["kind"] + " " + h["action"] + (" = " + h["text"] if h["text"] else "") for h in s["history"]]
+print(json.dumps({"status": s["status"], "url": p.get("url"), "title": p.get("title"), "steps": steps, "ms": s["elapsed_ms"], "text": (p.get("text") or "")[:6000]}))
+`
+
+/**
+ * The process that runs a browse call, or the error to hand back. jev-ultrafast speaks only TypeSafe's endpoint, and
+ * types into fields with a small text model: TEXT_MODEL_API_KEY, else OPENROUTER_API_KEY with mercury-2.5.
+ */
+export function browseCommand(
+  input: { url?: unknown; goal?: unknown; values?: unknown },
+  c: Config,
+  env: Readonly<Record<string, string | undefined>>,
+): { argv: string[]; env: Record<string, string> } | string {
+  const url = typeof input.url === 'string' ? input.url.trim() : ''
+  const goal = typeof input.goal === 'string' ? input.goal.trim() : ''
+  if (!/^https?:\/\/\S+$/i.test(url)) return 'url must be an http(s) URL'
+  if (!goal) return 'goal is required'
+  const typesafe = c.apiKey || env.TYPESAFE_API_KEY
+  if (!typesafe) return 'browse needs a TypeSafe key (TYPESAFE_API_KEY or the apiKey setting); OpenRouter does not serve its requests'
+  const text: Record<string, string> = env.TEXT_MODEL_API_KEY
+    ? { TEXT_MODEL_API_KEY: env.TEXT_MODEL_API_KEY }
+    : env.OPENROUTER_API_KEY
+      ? { TEXT_MODEL_API_KEY: env.OPENROUTER_API_KEY, TEXT_MODEL_BASE_URL: 'https://openrouter.ai/api/v1', TEXT_MODEL: 'inception/mercury-2.5', TEXT_MODEL_REASONING: 'none' }
+      : {}
+  return {
+    argv: ['uv', 'run', '--no-project', '--quiet', '--with', JEV_ULTRAFAST, 'python', '-c', BROWSE_PY, url, goal],
+    env: { TYPESAFE_API_KEY: typesafe, ...text, ...(Array.isArray(input.values) ? { OMJ_BROWSE_VALUES: JSON.stringify(input.values.filter(v => typeof v === 'string').slice(0, 20)) } : {}) },
+  }
+}
+
+/** The runner's stdout as the tool's text: its JSON line, or an error that says what to fix. */
+export function browseReply(stdout: string, stderr = ''): string {
+  const line = stdout.trim().split('\n').at(-1) ?? ''
+  try {
+    const out = JSON.parse(line) as { error?: string }
+    if (out.error && /TEXT_MODEL_API_KEY/.test(out.error)) out.error += '. Pass the text to type in values, or set OPENROUTER_API_KEY'
+    return JSON.stringify(out)
+  } catch {
+    const why = /No such file|ENOENT|not found/i.test(stderr) ? 'uv is not installed (https://docs.astral.sh/uv)' : clip(stderr.trim() || 'no output', 500)
+    return JSON.stringify({ error: `browse could not run: ${why}. Chrome needs remote debugging allowed the first time.` })
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",
@@ -15,6 +15,8 @@
     "pi",
     "claude-code",
     "claude-code-plugin",
+    "codex",
+    "codex-plugin",
     "jev",
     "guardrails",
     "ai-agent",
@@ -144,6 +146,11 @@
         "description": "Expose the ask_jev tool for quick judgments about repo files or text",
         "default": true
       },
+      "browse": {
+        "type": "boolean",
+        "description": "Expose a browse tool: jev-ultrafast does a task in your Chrome, Jev picking each step. Needs uv, Chrome remote debugging, and OPENROUTER_API_KEY to type into fields",
+        "default": false
+      },
       "autoCompact": {
         "type": "boolean",
         "description": "Compact after Jev sees a task change at a natural boundary",
@@ -243,7 +250,8 @@
   },
   "scripts": {
     "test": "bun test adapters && claude plugin test .",
-    "typecheck": "tsc -p . && tsc -p tsconfig.adapters.json"
+    "typecheck": "tsc -p . && tsc -p tsconfig.adapters.json",
+    "build:codex": "bun build codex/main.ts --target=node --format=esm --outfile=codex/ohmyjev.mjs"
   },
   "devDependencies": {
     "@types/bun": "^1.4.2",