ohmyjev 0.7.1 → 0.9.0

package/README.md

@@ -13,8 +13,8 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ```
 
 <p align="center">
-  Guardrails for Claude Code, Codex, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
-  One mod that stops irreversible and data-leaking commands, even in bypass mode, and runs them when you say yes. It also flags prompt injection, pushes back on an unverified "done" and routes effort per turn.
+  <a href="https://typesafe.ai">Jev</a>, batteries included, for Claude Code, Codex, pi and omp.<br>
+  One install that makes your coding agent faster and safer: no permission prompts for safe commands, long output cut to what matters, the right skill loaded, and nothing irreversible until you say yes.
 </p>
 
 <p align="center">
@@ -40,13 +40,14 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ---
 
 Jev is TypeSafe's decision model. You send it some state and a few typed questions, and it sends back probabilities
-in about 300 ms for a fraction of a cent. That's fast and cheap enough to ask about every command your agent runs, so
-ohmyjev does exactly that. It runs as in-process hooks inside Claude Code, which means no extra process and no server
-to keep up.
+in about 200 ms for a fraction of a cent. That's cheap enough to ask about every step your agent takes, so ohmyjev asks
+it everywhere a coding agent wastes your time or puts your work at risk: which command needs your OK, which part of a
+long log matters, which skill a prompt needs, whether the agent is going in circles, and whether a command can be
+undone. It runs as in-process hooks, so there's no extra process and no server to keep up.
 
-The bash gate is the core. An agent running unattended in bypass mode can't wipe a directory, force push over `main` or
-upload your keys, and it never stops to ask you for permission. When it blocks something, the agent tells you why and
-asks. Answer yes and that exact command runs. Everything else here builds on the same cheap, per-call judgment.
+Most of it makes the agent faster. The bash gate keeps it safe: an agent running unattended in bypass mode can't wipe a
+directory, force push over `main` or upload your keys. When it blocks something, the agent tells you why and asks.
+Answer yes and that exact command runs.
 
 ## Quick start
 
@@ -65,6 +66,19 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 
 ## What you get
 
+### Faster
+
+| Feature | What it does |
+|---|---|
+| **Auto-approve** | Where Claude Code or Codex would stop to ask you, a command Jev is sure only reads or can be undone, or an edit inside the repo with no credential in it, runs without the prompt. Plain reads like `ls`, `git status` and `grep` are cleared by code, with no Jev call at all. Off whenever you've set `policies`. |
+| **Trim long output** | A shell output over 12000 characters is split into parts, and one Jev call rates which parts your request needs: the error, the failing test, the value you asked for. The rest becomes one line saying how much was left out. A 20000-character test log came back as 4600 with the one failure in it. |
+| **Skill picker** | Claude Code sends the model a line for every skill you have on every prompt. ohmyjev leaves that list out and asks Jev whether a prompt needs a skill and which one, then names it beside your prompt. A second check makes sure the pick does the job, so a prompt no skill fits gets none. |
+| **Stuck check** | After the third failed tool call in a request, Jev reads the failures. If they repeat one approach and fail the same way, the agent is told to stop, read the error and try something else, or ask you. |
+| **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
+| **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
+
+### Safer
+
 | Feature | What it does |
 |---|---|
 | **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more, or when it sends local files or secrets to an outside host (0.7), such as `curl` uploading `~/.ssh`. A command Jev calls irreversible with less confidence is denied too when it also aims to wipe something (0.7). Reversible work always passes, so deleting lines, dropping a co-author trailer or uninstalling a plugin goes through. Plain reads like `ls`, `git status` or `grep` skip Jev entirely: plain code checks them, so they cost nothing and wait for nothing. |
@@ -74,9 +88,13 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 | **Your request** | Every gate also asks Jev whether your latest message asked for exactly this call. If it did (0.8), a gate's Jev deny lets the call through. So "delete the build folder" or "force push it" works, while the same command picked by the agent on its own is still denied. After a block, a plain "yes" works too: the gate shows Jev the call it just blocked next to your reply. Policy and path denies always stand. |
 | **Injection screen** | When output from Bash, WebFetch, an MCP tool, or a Read outside the repo has instructions aimed at the model, it adds a note telling the model to treat that output as data. |
 | **Done-check** | If the agent says it's done but nothing shows it ran a check, it blocks the stop once and tells the agent to verify. A turn that ran no tools is never blocked, since there was nothing to verify. |
-| **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
-| **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
+
+### Tools and commands
+
+| Feature | What it does |
+|---|---|
 | **`ask_jev`** | A tool the model can use to ask Jev about repo files or text without loading them into its own context. |
+| **`browse`** | A tool that does a web task in a headless browser, with Jev picking each click and field: a Google Flights search in about 6 seconds. Off until you turn on `browse`. |
 | **`/omj`** | This session's Jev calls, errors, cost, median latency and denies, and where the key comes from. It never prints the key. `/omj config` lists and changes settings. `/omj stats` opens a dashboard of every session in your browser. `/omj off` and `/omj on` switch ohmyjev for the session. `/ohmyjev` is the same command. |
 
 ### How a tool call goes through it
@@ -85,18 +103,21 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 flowchart LR
     A[Claude calls a tool] --> B{ohmyjev asks Jev}
     B -- clearly risky --> C[Denied, with the reason]
+    B -- clearly safe --> E
     B -- fine or unsure --> D[Claude Code's normal permission flow]
     B -- Jev down, slow or no key --> D
     D --> E[Tool runs]
-    E --> F{Output has instructions<br>aimed at the model?}
+    E --> T[Long output trimmed<br>to what the request needs]
+    T --> F{Output has instructions<br>aimed at the model?}
     F -- yes --> G[Model gets a<br>'treat as data' note]
     F -- no --> H[Output as is]
 ```
 
-Anything ohmyjev doesn't deny just goes on to Claude Code's normal permission flow. That covers middling answers, Jev
-being down or slower than `timeoutMs` (1.5 s), a missing key, and any error inside ohmyjev. It never stops to ask you to approve
-anything, so it works fine with agents running in bypass mode. Jev can be wrong though, so keep your deny rules in
-`settings.json`.
+Anything ohmyjev neither denies nor clears goes on to Claude Code's normal permission flow. That covers middling
+answers, Jev being down or slower than `timeoutMs` (1.5 s), a missing key, and any error inside ohmyjev. It never adds a
+prompt of its own, so it works fine with agents running in bypass mode. It only removes prompts: auto-approve answers
+"allow" only where the engine was about to ask and your settings left the call open. Jev can be wrong though, so keep
+your deny rules in `settings.json`.
 
 ## Install
 
@@ -159,8 +180,9 @@ codex plugin add ohmyjev@ohmyjev
 ```
 
 Then start Codex and run `/hooks` once: Codex skips a plugin's hooks until you trust them. ohmyjev needs Node on your
-`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, screens their
-output, and runs the done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
+`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, answers
+Codex's permission prompts for calls Jev cleared, trims long output, screens it, catches repeated failures, and runs the
+done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
 a tool, so there is no router, no `ask_jev` and no `/omj` command. Put settings in `~/.codex/ohmyjev.json`, using the
 names in [Settings](#settings):
 
@@ -209,10 +231,14 @@ pi has no settings screen for extensions, so put yours under an `ohmyjev` key in
 | Exfil gate | WebFetch, MCP tools | MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
 | Injection screen | Bash, WebFetch, MCP, Reads outside the repo | Bash, MCP | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
 | Done-check | ✓ | ✓ | ✓ | ✓ |
+| Auto-approve | ✓ | ✓ (PermissionRequest) | none: omp doesn't ask | none: pi doesn't ask |
+| Trim long output | Bash | Bash (the trimmed text replaces the result) | `bash` | `bash`, `powershell` |
+| Stuck check | ✓ | ✓ | ✓ | ✓ |
+| Skill picker | ✓ | none: hooks can't remove the skill list | none | none |
 | Router effort | ✓ | none: hooks can't set it | ✓ (left alone while you're on `auto`) | ✓ |
 | Router subagent model | general-purpose subagents | none | subagents on the default `task` role | none: pi has no subagents |
 | Router without a key | Claude Code's built-in classifier, up only | none | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
-| `/omj`, `ask_jev` | ✓ | none: hooks can't add commands or tools | ✓ | ✓ |
+| `/omj`, `ask_jev`, `browse` | ✓ | none: hooks can't add commands or tools | ✓ | ✓ |
 | Decision lines | in the transcript | the log only | notifications | notifications |
 | Status | under the prompt | none | in the footer | in the footer |
 
@@ -275,6 +301,31 @@ The model can call this tool on its own when it needs a judgment about files wit
 Jev reads the files, not the model. ohmyjev only sends files that are inside the repo, up to 8000 characters each and
 80000 in total.
 
+### `browse`
+
+Turn it on with `/omj config browse on`, or `browse` in the settings. The model then has a `browse` tool for tasks on a
+website: give it a starting URL, one narrow goal, and the text it may type.
+
+```json
+{
+  "url": "https://www.google.com/travel/flights?hl=en",
+  "goal": "Find one-way flights from Zurich to London on November 20, 2026. Stop when flight options show.",
+  "values": ["Zurich", "London", "Nov 20, 2026"]
+}
+```
+
+Each step, Jev reads the page's controls and picks one action and its target in a single request, and when a field
+needs text it picks the right entry from `values`. That run took 11 steps and 5.5 seconds: one-way, both cities, the
+date, search. The tool returns where it ended, the steps and the page's visible text, and that text goes through the
+injection screen like any tool output. The exfil gate checks the goal first, so a goal that would carry your files to a
+website is denied before the browser opens.
+
+It is [browser-use/jev-ultrafast](https://github.com/browser-use/jev-ultrafast) (MIT), pinned to one commit, run through
+[uv](https://docs.astral.sh/uv), so install uv once. It starts its own headless Chrome, Chromium, Brave or Edge with
+a profile in `~/.ohmyjev/browser`, signed in to nothing, and closes it after the task. Set `CHROME_PATH` to choose the
+browser. With `OPENROUTER_API_KEY` or `TEXT_MODEL_API_KEY` set, a small text model writes field text instead of picking
+from `values`. Use WebFetch for a page the model only needs to read.
+
 ### In the transcript
 
 Each routing decision shows up as a dim line in the transcript. The model never sees these lines. First what Jev
@@ -353,6 +404,11 @@ one for the session. To keep a change, run `/plugin configure ohmyjev@ohmyjev` i
 | `routeWithoutKey` | on | With no key, routes with Claude Code's built-in classifier instead. It has no confidence, so it only routes up. |
 | `autoCompact` | on | Compacts when the task changes. `compactMinPercent` (40) sets how full the context has to be first. |
 | `askJev` | on | Gives the model the `ask_jev` tool. |
+| `browse` | off | Gives the model the `browse` tool. Needs uv and a Chromium-based browser. |
+| `autoApprove` | on | Skips the permission prompt for a call Jev is sure is safe. `approveConfidence` (0.9) and `approveRiskMax` (0.2) set how sure. |
+| `trimOutput` | on | Cuts long shell output to what the request needs. `trimOver` (12000 characters) and `trimKeep` (0.3) tune it. |
+| `stuckCheck` | on | Tells the agent to change course when its failures repeat. `stuck` (0.7) sets how sure Jev must be. |
+| `skillPick` | on | Claude Code: leaves the skill list out and names the one skill a prompt needs. `skillGate` (0.3) and `skillMin` (0.4) tune it. |
 | `policies` | empty | Your own rules, separated by `;`. |
 | `allowPaths` | `~/.claude;$TMPDIR;/tmp` | Places outside the repo where writes are allowed. ohmyjev ignores any entry with `..` in it. You don't need it for a sibling worktree or another git repo the agent `cd`s into: those count as the repo. |
 | `fastModel`, `balancedModel`, `deepModel` | `claude-haiku-5-5`, `claude-sonnet-5-5`, `claude-opus-5-5` | The model id for each router tier. |
@@ -383,7 +439,11 @@ a fixed size:
 | Injection screen | The tool's output (up to 6000 characters), from Bash, WebFetch, MCP tools and Reads outside the repo |
 | Done-check | The current request (600), up to five earlier requests (200 each), up to 20 of this turn's tool calls with their input (200 each) and outcome, and Claude's last message (1500) |
 | Router | The request (up to 1500 characters) |
+| Trim long output | Your latest message (1500) and the long output, in parts of about 1500 characters, up to 24 parts |
+| Stuck check | Your latest message (600) and the last six failed calls: each one's input and the end of its output (300 each) |
+| Skill picker | Each prompt (1500) with every skill's name and one-line description (300 each); then the picked skill's description (600) |
 | `ask_jev` | The model's question, any text it passes (up to 20000 characters) and the repo files it names (8000 each, 80000 in total). It never sends files outside the repo |
+| `browse` | The goal and URL to the exfil gate; then, each step, the page's controls and visible text (6000) and the goal to Jev, and the page's text to the injection screen. The websites see the browser like any visitor |
 
 The write and exfil gates also send your latest message (1500), for the request check. When you've set `policies`,
 every gate sends those too. Turning a feature off stops its calls.
@@ -440,4 +500,5 @@ The design and plans are in [`docs/superpowers`](docs/superpowers).
 
 ## Credits
 
-The question rubrics come from [disler/ten-levels-of-jev](https://github.com/disler/ten-levels-of-jev). MIT license.
+The question rubrics come from [disler/ten-levels-of-jev](https://github.com/disler/ten-levels-of-jev). `browse` runs
+[browser-use/jev-ultrafast](https://github.com/browser-use/jev-ultrafast). Both MIT.

package/adapters/codex.ts

@@ -7,15 +7,17 @@
  */
 import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import {
-  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, callSummary, clip, denyText, gateBash, gateExfil, gateWrite,
+  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, approveBash, approveWrite, callSummary, clip, clipTail, denyText, gateBash, gateExfil, gateWrite,
   judgeStop, pathDenyText, plainRead, readConfig, sanitizeSid, screen, withPolicies, withPolicyQ, type Config,
 } from '../hooks/policy.ts'
-import { Session, keyOf, pathAllowed, repoRoot, type Env, type Fetch } from './shared.ts'
+import { Session, keyOf, newStuck, pathAllowed, repoRoot, stuckNote, trimOutput, type Env, type Fetch, type Stuck } from './shared.ts'
 
 const CLIP = 16000
-type Tool = { tool: string; input: string; outcome: 'ok' | 'failed' }
-type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number }
-const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1 }
+type Tool = { tool: string; input: string; outcome: 'ok' | 'failed'; output: string }
+type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number; approved: string[]; stuck: Stuck }
+const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1, approved: [], stuck: { failures: [], askedAt: 0 } }
+/** A call Jev cleared, as PermissionRequest will see it again. */
+const approvalKey = (tool: string, input: Input): string => `${tool}\u0000${str(input, 'command')}`
 type Input = Record<string, unknown>
 const str = (o: Input, k: string): string => (typeof o[k] === 'string' ? (o[k] as string) : '')
 const obj = (v: unknown): Input => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Input) : {})
@@ -63,7 +65,7 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     const prompt = str(input, 'prompt')
     if (!prompt.trim() || /^\/\S+\s*$/.test(prompt.trim())) return undefined
     if (st.request) st.previous = [...st.previous, clip(st.request, 200)].slice(-5)
-    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [] })
+    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [], stuck: newStuck() })
     await save(env, sid, st)
     return undefined
   }
@@ -73,7 +75,14 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
   const toolInput = obj(input.tool_input)
 
   if (event === 'PreToolUse') {
-    const blocked = async (j: { verdict: unknown; reason: string }) => {
+    const approve = async () => {
+      if (!c.autoApprove) return undefined
+      st.approved = [...st.approved, approvalKey(tool, toolInput)].slice(-20)
+      await save(env, sid, st)
+      return undefined
+    }
+    const blocked = async (j: { verdict: unknown; reason: string }, safe = false) => {
+      if (j.verdict === null && safe) return approve()
       if (j.verdict !== 'deny') return undefined
       st.lastBlocked = callSummary(tool, toolInput)
       await save(env, sid, st)
@@ -81,13 +90,13 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     }
     if (tool === 'Bash' && c.bashGate) {
       const command = str(toolInput, 'command')
-      if (plainRead(command, c)) return undefined
+      if (plainRead(command, c)) return approve()
       const state = withPolicies({ command: clip(command, CLIP), cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, st.request, st.blockedBefore)
       const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, st.request))
       if (!d) return undefined
       const j = gateBash(d.answers, c)
       x.record(d, j.verdict, j.reason)
-      return blocked(j)
+      return blocked(j, approveBash(d.answers, c))
     }
     if (tool === 'apply_patch' && c.writeGate) {
       const patch = str(toolInput, 'command')
@@ -102,7 +111,7 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
       if (!d) return undefined
       const j = gateWrite(d.answers, c)
       x.record(d, j.verdict, j.reason)
-      return blocked(j)
+      return blocked(j, approveWrite(d.answers, c))
     }
     if (tool.startsWith('mcp__') && c.exfilGate) {
       const state = withPolicies({ tool, input: clip(JSON.stringify(toolInput), 4000) }, c, st.request, st.blockedBefore)
@@ -115,19 +124,35 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     return undefined
   }
 
+  if (event === 'PermissionRequest') {
+    const key = approvalKey(tool, toolInput)
+    if (!c.autoApprove || !st.approved.includes(key)) return undefined
+    st.approved = st.approved.filter(k => k !== key)
+    await save(env, sid, st)
+    return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'allow' } } }
+  }
+
   if (event === 'PostToolUse') {
     const response = input.tool_response
     const code = obj(response).exit_code ?? obj(response).exitCode
-    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok' } as Tool].slice(-20)
+    const r = obj(response)
+    const shown = typeof response === 'string' ? response : typeof r.output === 'string' ? r.output : typeof r.stdout === 'string' ? r.stdout : JSON.stringify(response ?? '')
+    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok', output: clipTail(shown, 300) } as Tool].slice(-20)
+    const failed = typeof code === 'number' && code !== 0
+    const stuck = failed ? await stuckNote(x, st.stuck, st.request, tool, toolInput, shown) : null
     await save(env, sid, st)
-    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__'))) return undefined
-    const text = typeof response === 'string' ? response : JSON.stringify(response ?? '')
-    if (!text.trim()) return undefined
-    const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
-    if (!d) return undefined
+    const notes = stuck ? [stuck] : []
+    // a cut output replaces the result: Codex hooks can't edit it, but a PostToolUse block's reason stands in for it
+    const cut = tool === 'Bash' ? await trimOutput(x, st.request, shown) : null
+    if (cut) return { decision: 'block', reason: [cut, ...notes].join('\n') }
+    const context = () => (notes.length ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: notes.join('\n') } } : undefined)
+    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__')) || !shown.trim()) return context()
+    const d = await x.decide('tool.result', tool, { tool, content: clip(shown, 6000) }, SCREEN_Q)
+    if (!d) return context()
     const s = screen(d.answers, c)
     x.record(d, s.flagged ? 'flag' : null, s.reason)
-    return s.flagged ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: s.note } } : undefined
+    if (s.flagged) notes.push(s.note)
+    return context()
   }
 
   if (event === 'Stop') {

package/adapters/omp.ts

@@ -4,13 +4,13 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand, applyPatchPaths,
-  OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, clipTail, plainRead, configCommand, applyPatchPaths,
+  BROWSE_DESCRIPTION, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, Session, answerAsk, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, Session, answerAsk, newStuck, runBrowse, stuckNote, trimOutput, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -193,16 +193,18 @@ function sameModel(left: HostModel | undefined, right: HostModel | undefined): b
   )
 }
 
-function toolState(messages: unknown[], after: number): Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> {
+function toolState(messages: unknown[], after: number): Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> {
   const tail = messages.slice(after)
   const outcomes = new Map<string, 'ok' | 'failed'>()
+  const outputs = new Map<string, string>()
   for (const message of tail) {
     const m = object(message)
     if (m.role !== 'toolResult') continue
     const id = typeof m.toolCallId === 'string' ? m.toolCallId : ''
     if (id) outcomes.set(id, m.isError === true ? 'failed' : 'ok')
+    if (id) outputs.set(id, clipTail(text(m.content), 300))
   }
-  const calls: Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> = []
+  const calls: Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> = []
   for (const message of tail) {
     const m = object(message)
     if (m.role !== 'assistant' || !Array.isArray(m.content)) continue
@@ -214,6 +216,7 @@ function toolState(messages: unknown[], after: number): Array<{ tool: string; in
         tool: typeof p.name === 'string' ? p.name : '',
         input: clip(safeJson(p.arguments), 200),
         outcome: outcomes.get(id) ?? 'pending',
+        output: outputs.get(id) ?? '',
       })
     }
   }
@@ -247,10 +250,12 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     let liveRequest = ''
     let lastBlocked = '' // the call a gate denied this turn
     let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let stuck = newStuck()
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let classifiedPrompt: string | undefined
     let askRegistered = false
+    let browseRegistered = false
     let sessionGeneration = 0
     let userEffort: string | undefined
     const routedThinkingEntries = new Set<string>()
@@ -423,6 +428,35 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         })
         askRegistered = true
       }
+      if (c.browse && !browseRegistered) {
+        const t = pi.typebox.Type
+        pi.registerTool({
+          name: 'browse',
+          label: 'Browse',
+          description: BROWSE_DESCRIPTION,
+          parameters: t.Object({
+            url: t.String({ description: 'Where to start, an http(s) URL' }),
+            goal: t.String({ description: 'One narrow goal, and when to stop' }),
+            values: t.Optional(t.Array(t.String(), { description: 'Exact text the task may type; Jev puts each into the field that needs it' })),
+          }),
+          approval: 'exec',
+          async execute(_id, params, _signal, _update, toolCtx) {
+            try {
+              touch(toolCtx)
+              if (!session) return { content: [{ type: 'text', text: JSON.stringify({ error: 'jev session unavailable' }) }] }
+              const r = await runBrowse(session, params, userRequest, blockedBefore)
+              if ('deny' in r) {
+                lastBlocked = callSummary('browse', params)
+                return { content: [{ type: 'text', text: r.deny }], details: {}, isError: true }
+              }
+              return { content: [{ type: 'text', text: r.text }], details: {} }
+            } catch {
+              return { content: [{ type: 'text', text: JSON.stringify({ error: 'browse failed' }) }], details: {} }
+            }
+          },
+        })
+        browseRegistered = true
+      }
     }
 
     const reinitialize = async (ctx: HostContext): Promise<void> => {
@@ -543,23 +577,30 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     pi.on('tool_result', async (rawEvent, ctx) => {
       try {
         touch(ctx)
-        if (!session || !c.enabled || !c.injectionScreen) return
+        if (!session || !c.enabled) return
         const event = rawEvent as ToolResult
         const tool = event.toolName
         const input = object(event.input)
+        let resultText = event.content.map(part => part.type === 'text' && typeof part.text === 'string' ? part.text : '').filter(Boolean).join('\n')
+        const cut = tool === 'bash' ? await trimOutput(session, userRequest, resultText) : null
+        if (cut) resultText = cut
+        const base = cut ? [...event.content.filter(part => part.type !== 'text'), { type: 'text', text: cut }] : event.content
+        const stuckText = (event as { isError?: boolean }).isError ? await stuckNote(session, stuck, userRequest, tool, input, resultText) : null
+        const content = stuckText ? [...base, { type: 'text', text: stuckText }] : base
+        const changed = stuckText || cut
+        if (!c.injectionScreen) return changed ? { content } : undefined
         let shouldScreen = tool === 'bash' || tool === 'github' || exfilTool(tool, input)
         if (tool === 'read' && !urlRead(tool, input) && c.screenReads) {
           const path = string(input, 'path')
           shouldScreen = !sessionLocalWrite(path) && !(await pathAllowed(path, ctx.cwd, root, c, env))
         }
-        if (!shouldScreen) return
-        const resultText = event.content.map(part => part.type === 'text' && typeof part.text === 'string' ? part.text : '').filter(Boolean).join('\n')
-        if (!resultText.trim()) return
+        if (!shouldScreen || !resultText.trim()) return changed ? { content } : undefined
         const d = await session.decide('tool_result', tool, { tool, content: clip(resultText, 6000) }, SCREEN_Q)
-        if (!d) return
+        if (!d) return changed ? { content } : undefined
         const screened = screen(d.answers, c)
         session.record(d, screened.flagged ? 'flag' : null, screened.reason)
-        if (screened.flagged) return { content: [...event.content, { type: 'text', text: screened.note }] }
+        if (screened.flagged) return { content: [...content, { type: 'text', text: screened.note }] }
+        return changed ? { content } : undefined
       } catch {
         return
       }
@@ -620,6 +661,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         userEffort = userThinking(ctx)
         const prompt = typeof rawEvent.prompt === 'string' ? rawEvent.prompt : ''
         if (prompt.trim() && !/^\/\S+\s*$/.test(prompt.trim())) {
+          stuck = newStuck()
           userRequest = prompt
           blockedBefore = lastBlocked
           lastBlocked = ''

package/adapters/pi.ts

@@ -1,13 +1,13 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand,
-  OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
+  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, clipTail, plainRead, configCommand,
+  BROWSE_DESCRIPTION, BROWSE_SCHEMA, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, newStuck, runBrowse, stuckNote, trimOutput, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -173,20 +173,23 @@ function messagesForStop(messages: HostMessage[]) {
     }
   }
 
-  const tools: Array<{ id: string; tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> = []
+  const tools: Array<{ id: string; tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> = []
   const byId = new Map<string, (typeof tools)[number]>()
   for (const message of messages.slice(lastRequest + 1)) {
     if (message.role === 'assistant' && Array.isArray(message.content)) {
       for (const part of message.content) {
         const block = entry(part)
         if (block.type !== 'toolCall' || typeof block.id !== 'string' || typeof block.name !== 'string') continue
-        const call = { id: block.id, tool: block.name, input: clip(json(block.arguments), 200), outcome: 'pending' as const }
+        const call = { id: block.id, tool: block.name, input: clip(json(block.arguments), 200), outcome: 'pending' as 'ok' | 'failed' | 'pending', output: '' }
         tools.push(call)
         byId.set(call.id, call)
       }
     } else if (message.role === 'toolResult' && typeof message.toolCallId === 'string') {
       const call = byId.get(message.toolCallId)
-      if (call) call.outcome = message.isError ? 'failed' : 'ok'
+      if (call) {
+        call.outcome = message.isError ? 'failed' : 'ok'
+        call.output = clipTail(textOf(message.content), 300)
+      }
     }
   }
 
@@ -196,7 +199,7 @@ function messagesForStop(messages: HostMessage[]) {
     state: {
       current_request: clip(textOf(requests.at(-1)?.content), 600),
       previous_requests: requests.slice(-6, -1).map(message => clip(textOf(message.content), 200)),
-      tools_this_turn: tools.slice(-20).map(({ tool, input, outcome }) => ({ tool, input, outcome })),
+      tools_this_turn: tools.slice(-20).map(({ tool, input, outcome, output }) => ({ tool, input, outcome, output })),
       last_assistant_message: clip(textOf(lastAssistant?.content), 1500),
     },
   }
@@ -259,6 +262,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
     let liveRequest = ''
     let lastBlocked = '' // the call a gate denied this turn
     let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let stuck = newStuck()
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let userThinking: ThinkingLevel = 'medium'
@@ -354,6 +358,29 @@ export function createExtension(options: PiAdapterOptions = {}) {
       })
       askRegistered = true
     }
+    let browseRegistered = false
+    const registerBrowse = (): void => {
+      if (browseRegistered || !c.browse) return
+      pi.registerTool({
+        name: 'browse',
+        label: 'Browse',
+        description: BROWSE_DESCRIPTION,
+        parameters: BROWSE_SCHEMA,
+        async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+          try {
+            const r = await runBrowse(await ensureSession(ctx), params, userRequest, blockedBefore)
+            if ('deny' in r) {
+              lastBlocked = callSummary('browse', params)
+              return { content: [{ type: 'text', text: r.deny }], details: undefined, isError: true }
+            }
+            return { content: [{ type: 'text', text: r.text }], details: undefined }
+          } catch {
+            return { content: [{ type: 'text', text: JSON.stringify({ error: 'browse failed' }) }], details: undefined }
+          }
+        },
+      })
+      browseRegistered = true
+    }
 
     /** /omj and /ohmyjev: the report, `settings`, or `on`/`off` for this session (the enabled setting is the default). */
     const command = async (args: string, ctx: PiContext): Promise<void> => {
@@ -389,6 +416,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
       userThinking = pi.getThinkingLevel()
       const x = await ensureSession(ctx)
       registerAsk()
+      registerBrowse()
       const key = keyOf(c, env)
       say(
         ctx,
@@ -415,6 +443,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
     pi.on('before_agent_start', guarded<BeforeAgentStartEvent, void>(async (event, ctx) => {
       latestCtx = ctx
       if (event.prompt.trim() && !/^\/\S+\s*$/.test(event.prompt.trim())) {
+        stuck = newStuck()
         userRequest = event.prompt
         blockedBefore = lastBlocked
         lastBlocked = ''
@@ -495,27 +524,38 @@ export function createExtension(options: PiAdapterOptions = {}) {
       }
     }))
 
-    pi.on('tool_result', guarded<ToolResultEvent, { content: Content[]; structuredContent?: unknown }>(async (event, ctx) => {
+    pi.on('tool_result', guarded<ToolResultEvent, { content: Content[]; structuredContent?: unknown }>(async (evt, ctx) => {
+      let event = evt
       latestCtx = ctx
       if (!c.enabled) return
       const tool = event.toolName
       const shell = tool === 'bash' || tool === 'powershell'
-      if (!c.injectionScreen || (event.isError && !shell)) return
+      let text = event.content.filter((part): part is TextContent => part.type === 'text').map(part => part.text).join('\n')
+      const cut = shell ? await trimOutput(await ensureSession(ctx), userRequest, text) : null
+      if (cut) {
+        text = cut
+        event = { ...event, content: [...event.content.filter(part => part.type !== 'text'), { type: 'text', text: cut }] }
+      }
+      const stuckText = event.isError ? await stuckNote(await ensureSession(ctx), stuck, userRequest, tool, event.input, text) : null
+      const withStuck = stuckText
+        ? { content: [...event.content, { type: 'text' as const, text: stuckText }], ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}) }
+        : undefined
+      const changed = withStuck ?? (cut ? { content: event.content, ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}) } : undefined)
+      if (!c.injectionScreen || (event.isError && !shell)) return changed
       const candidate = shell || tool.startsWith('mcp__') || tool === 'read'
-      if (!candidate) return
+      if (!candidate) return changed
       if (tool === 'read') {
-        if (!c.screenReads || await pathAllowed(arg(event.input, 'path'), ctx.cwd, root, c, env)) return
+        if (!c.screenReads || await pathAllowed(arg(event.input, 'path'), ctx.cwd, root, c, env)) return changed
       }
-      const content = event.content.filter((part): part is TextContent => part.type === 'text').map(part => part.text).join('\n')
-      if (!content.trim()) return
+      if (!text.trim()) return changed
       const x = await ensureSession(ctx)
-      const d = await x.decide('tool.result', tool, { tool, content: clip(content, 6000) }, SCREEN_Q)
-      if (!d) return
+      const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
+      if (!d) return changed
       const judged = screen(d.answers, c)
       x.record(d, judged.flagged ? 'flag' : null, judged.reason)
-      if (!judged.flagged) return
+      if (!judged.flagged) return changed
       return {
-        content: [...event.content, { type: 'text', text: judged.note }],
+        content: [...(changed?.content ?? event.content), { type: 'text', text: judged.note }],
         ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}),
       }
     }))

package/adapters/shared.ts

@@ -8,8 +8,8 @@ import { appendFile, chmod, lstat, mkdir, readFile, readdir, realpath, writeFile
 import { dashboardHtml } from '../hooks/dashboard.ts'
 import { ENDPOINTS, JevError, parseReply, pickKey, type Key } from '../hooks/jev.ts'
 import {
-  DASHBOARD, EMPTY_SESSION, absolute, buildQuestion, clip, expandRoot, hostPath, isUnder, normalize, parseLog, parseWorktrees, rawAbsolute, sanitizeSid,
-  splitList, statusText, summarize, type Answers, type Config, type LogEntry, type Questions, type SessionState, type Verdict,
+  BROWSE_TIMEOUT_MS, DASHBOARD, EMPTY_SESSION, EXFIL_Q, SCREEN_Q, browseCommand, browseReply, denyText, gateExfil, screen, withPolicies, withPolicyQ, absolute, buildQuestion, clip, expandRoot, hostPath, isUnder, normalize, parseLog, parseWorktrees, rawAbsolute, sanitizeSid,
+  STUCK_Q, trimChunks, trimRequest, trimmed, failureOf, judgeStuck, stuckDue, stuckState, splitList, statusText, summarize, type Failure, type Answers, type Config, type LogEntry, type Questions, type SessionState, type Verdict,
 } from '../hooks/policy.ts'
 
 export type Env = Readonly<Record<string, string | undefined>>
@@ -288,3 +288,82 @@ export async function answerAsk(x: Session, input: Record<string, unknown>, cwd:
   x.record(d, null, 'asked')
   return JSON.stringify(d.answers.answer)
 }
+
+// --- browse: jev-ultrafast in the user's Chrome ---
+
+/** Runs a process to completion: its stdout and stderr, whatever the exit. Tests pass a fake. */
+export type Runner = (argv: string[], env: Record<string, string>, timeoutMs: number) => Promise<{ stdout: string; stderr: string }>
+const execRunner: Runner = (argv, env, timeoutMs) => {
+  const { promise, resolve } = Promise.withResolvers<{ stdout: string; stderr: string }>()
+  execFile(argv[0]!, argv.slice(1), { env: { ...process.env, ...env }, timeout: timeoutMs, maxBuffer: 4 << 20 }, (err, stdout, stderr) =>
+    resolve({ stdout: String(stdout ?? ''), stderr: String(stderr ?? '') || (err ? String(err) : '') }))
+  return promise
+}
+
+/**
+ * browse for pi and omp: the exfil gate on the call (the user's request can lift it), jev-ultrafast, then the
+ * injection screen on what came back. The text for the model, or a deny.
+ */
+export async function runBrowse(
+  x: Session,
+  input: Record<string, unknown>,
+  request = '',
+  blockedBefore = '',
+  run: Runner = execRunner,
+): Promise<{ text: string } | { deny: string }> {
+  const c = x.c
+  if (!c.browse) return { text: JSON.stringify({ error: 'browse is off: /omj config browse on' }) }
+  if (c.enabled && c.exfilGate) {
+    const state = withPolicies({ tool: 'browse', input: clip(JSON.stringify(input), 4000) }, c, request, blockedBefore)
+    const d = await x.decide('tool.call', 'browse', state, withPolicyQ(EXFIL_Q, c, request))
+    if (d) {
+      const j = gateExfil(d.answers, c)
+      x.record(d, j.verdict, j.reason)
+      if (j.verdict === 'deny') return { deny: denyText(j.reason) }
+    }
+  }
+  const cmd = browseCommand(input, c, x.env)
+  if (typeof cmd === 'string') return { text: JSON.stringify({ error: cmd }) }
+  const r = await run(cmd.argv, cmd.env, BROWSE_TIMEOUT_MS)
+  const text = browseReply(r.stdout, r.stderr)
+  if (!c.enabled || !c.injectionScreen) return { text }
+  const d = await x.decide('tool.result', 'browse', { tool: 'browse', content: clip(text, 6000) }, SCREEN_Q)
+  if (!d) return { text }
+  const s = screen(d.answers, c)
+  x.record(d, s.flagged ? 'flag' : null, s.reason)
+  return { text: s.flagged ? `${text}\n${s.note}` : text }
+}
+
+// --- stuck check: the same approach failing over and over ---
+
+/** One request's failed calls; reset it when the user sends a new request. */
+export type Stuck = { failures: Failure[]; askedAt: number }
+export const newStuck = (): Stuck => ({ failures: [], askedAt: 0 })
+
+/** Records a failed call and, when due, asks Jev whether the attempts repeat: the note for the model, or null. */
+export async function stuckNote(x: Session, st: Stuck, request: string, tool: string, input: unknown, output: unknown): Promise<string | null> {
+  if (!x.c.enabled || !x.c.stuckCheck) return null
+  st.failures.push(failureOf(tool, input, output))
+  if (!stuckDue(st.failures.length, st.askedAt)) return null
+  st.askedAt = st.failures.length
+  const d = await x.decide('tool.result', 'stuck', stuckState(request, st.failures), STUCK_Q)
+  if (!d) return null
+  const note = judgeStuck(d.answers, x.c, st.failures.length)
+  x.record(d, note ? 'flag' : null, note ? 'stuck' : 'not stuck')
+  return note
+}
+
+// --- output trim ---
+
+/** A long shell output cut to the parts the request needs; null to keep it whole. */
+export async function trimOutput(x: Session, request: string, output: string): Promise<string | null> {
+  if (!x.c.enabled) return null
+  const chunks = trimChunks(output, x.c)
+  if (!chunks.length) return null
+  const { state, questions } = trimRequest(request, chunks)
+  const d = await x.decide('tool.result', 'trim', state, questions)
+  if (!d) return null
+  const out = trimmed(chunks, d.answers, x.c)
+  x.record(d, null, out ? `trimmed ${output.length} to ${out.length} characters` : 'kept whole')
+  return out
+}

package/hooks/policy.ts

@@ -25,7 +25,19 @@ export const DEFAULTS = {
   doneAsksUserMax: 0.5,
   exfil: 0.7,
   requested: 0.8,
+  autoApprove: true,
+  stuckCheck: true,
+  skillPick: true,
+  skillGate: 0.3,
+  skillMin: 0.4,
+  trimOutput: true,
+  trimOver: 12000,
+  trimKeep: 0.3,
+  stuck: 0.7,
+  approveConfidence: 0.9,
+  approveRiskMax: 0.2,
   askJev: true,
+  browse: false,
   autoCompact: true,
   compactSwitched: 0.8,
   compactBoundary: 0.6,
@@ -184,12 +196,33 @@ export const STOP_Q: Questions = {
   claimed_done: noul('Does `last_assistant_message` say the task in `current_request` is complete?'),
   verified: noul(
     'Is there evidence the work was checked?',
-    'Tests, a build or the program ran and did not fail, output was quoted or inspected; `tools_this_turn` shows such a check with outcome ok',
+    'Tests, a build or the program ran and did not fail, output was quoted or inspected; `tools_this_turn` shows such a check with outcome ok and an `output` that confirms it',
     'Only claims success, edited without running or inspecting anything, or every check is pending, backgrounded or failed',
   ),
   asks_user: noul('Does `last_assistant_message` end by asking the user a question or reporting a blocker it cannot resolve?'),
   at_boundary: noul('Did the last turn finish a unit of work rather than stop mid-step?'),
 }
+export const STUCK_Q: Questions = {
+  stuck: noul(
+    'Do the attempts in `failures` repeat one approach and fail the same way, so trying it again will not help?',
+    'The same command, edit or fix, re-run with small changes, and the same error or the same kind of failure each time',
+    'Different approaches, different errors, or each attempt gets further than the last',
+  ),
+}
+/** A failed tool call, as the stuck check reads it. */
+export type Failure = { tool: string; input: string; output: string }
+export const failureOf = (tool: string, input: unknown, output: unknown): Failure =>
+  ({ tool, input: clip(typeof input === 'string' ? input : JSON.stringify(input), 300), output: clipTail(output, 300) })
+/** Ask after the third failure in a request, then after every third more: rarely, and only while it keeps failing. */
+export const stuckDue = (failures: number, askedAt: number): boolean => failures >= 3 && failures - askedAt >= 3
+export const stuckState = (request: string, failures: Failure[]) => ({ current_request: clip(request, 600), failures: failures.slice(-6) })
+export function judgeStuck(a: Answers, c: Config, n: number): string | null {
+  const p = nv(a, 'stuck')
+  return p >= c.stuck
+    ? `[ohmyjev] The last ${n} failed attempts repeat one approach and fail the same way (${f2(p)}). Stop repeating it: read the error, try a different approach, or ask the user.`
+    : null
+}
+
 export const SWITCHED_Q: Questions = {
   switched_gears: noul('Is `current_request` a different task from `previous_requests`, so the earlier work is no longer needed?'),
 }
@@ -203,6 +236,11 @@ export const clip = (text: unknown, n: number): string => {
   const s = typeof text === 'string' ? text : ''
   return s.length <= n ? s : s.slice(0, n - 1) + '…'
 }
+/** The end of a tool's output, where a test run's verdict and an error's last line are. */
+export const clipTail = (text: unknown, n: number): string => {
+  const s = typeof text === 'string' ? text.trim() : ''
+  return s.length <= n ? s : '…' + s.slice(-(n - 1))
+}
 export const sanitizeSid = (sid: string): string => sid.replace(/[^\w-]/g, '') || 'unknown'
 export const denyText = (reason: string): string => `ohmyjev blocked this: ${reason}. ${BLOCK_NOTICE}`
 /** A path deny is a setting, not a hazard: the model must not route around it, but it should tell the user how to widen it. */
@@ -287,6 +325,21 @@ export function gateBash(a: Answers, c: Config): Judged {
   return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}, exfil ${f2(out)}` }
 }
 
+/**
+ * Whether the host may skip asking the person: Jev is sure the command only reads or makes a change git or a reinstall
+ * undoes, and sees no wipe and no data leaving. Policies make every call worth a look, so nothing is approved then.
+ */
+export function approveBash(a: Answers, c: Config): boolean {
+  const effect = ch(a, 'effect')
+  return c.autoApprove && !splitList(c.policies).length && effect.choice !== 'irreversible' && effect.confidence >= c.approveConfidence &&
+    nv(a, 'destructive_intent') < c.approveRiskMax && nv(a, 'exfiltrates') < c.approveRiskMax
+}
+/** The same for an edit inside the repo: no credential in it, not a secrets file. */
+export function approveWrite(a: Answers, c: Config): boolean {
+  const kind = ch(a, 'kind')
+  return c.autoApprove && !splitList(c.policies).length && nv(a, 'contains_secret') < c.approveRiskMax && kind.choice !== 'secrets'
+}
+
 export function gateWrite(a: Answers, c: Config): Judged {
   const kind = ch(a, 'kind')
   const secret = nv(a, 'contains_secret')
@@ -592,3 +645,217 @@ export function summarize(log: string): string {
     ...denies.slice(-5).map(r => `  ${r.tool || r.event}: ${r.reason ?? ''}`),
   ].join('\n')
 }
+
+// --- browse: jev-ultrafast (github.com/browser-use/jev-ultrafast, MIT) drives Chrome, Jev picks each step ---
+
+export const JEV_ULTRAFAST = 'git+https://github.com/browser-use/jev-ultrafast@1231850a0bf1a0c0341fe408ef1668dbbfdfac46'
+export const BROWSE_TIMEOUT_MS = 180_000
+export const BROWSE_DESCRIPTION =
+  'Do a task in a real browser tab, fast: Jev picks each click, field and option from the page\'s controls (about one ' +
+  'second per step). Give a starting URL and one narrow goal, like "find one-way flights Zurich to London on Sept 20, ' +
+  'stop when results show" or "open the install section of these docs", with the text to type in `values`. Returns ' +
+  'where it ended, the steps taken and the visible text. Runs in its own headless browser, signed in to nothing. Use WebFetch for a page you only need to read.'
+export const BROWSE_SCHEMA = {
+  type: 'object',
+  properties: {
+    url: { type: 'string', description: 'Where to start, an http(s) URL' },
+    goal: { type: 'string', description: 'One narrow goal, and when to stop' },
+    values: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Exact text the task may type: names, dates, search terms ("Zurich", "London", "Sep 20, 2026"). Jev puts each into the field that needs it',
+    },
+  },
+  required: ['url', 'goal'],
+} as const
+
+/** Runs one jev-ultrafast Agent and prints one JSON line: where it ended, its steps, the visible text; or an error. */
+const BROWSE_PY = `
+import glob, json, os, shutil, subprocess, sys, tempfile, time
+
+def chromium():
+    if os.environ.get("CHROME_PATH"): return os.environ["CHROME_PATH"]
+    for app in ["Google Chrome", "Chromium", "Brave Browser", "Microsoft Edge"]:
+        p = f"/Applications/{app}.app/Contents/MacOS/{app}"
+        if os.path.exists(p): return p
+    for name in ["google-chrome", "chromium", "chromium-browser", "brave-browser", "microsoft-edge"]:
+        if shutil.which(name): return shutil.which(name)
+    home = os.path.expanduser("~")
+    found = sorted(glob.glob(home + "/Library/Caches/ms-playwright/chromium-*/chrome-mac*/*.app/Contents/MacOS/*")
+        + glob.glob(home + "/.cache/ms-playwright/chromium-*/chrome-linux*/chrome")
+        + glob.glob(home + "/.omp/puppeteer/chrome/*/*/*.app/Contents/MacOS/*"))
+    return found[-1] if found else None
+
+def headless():
+    exe = chromium()
+    if not exe: raise RuntimeError("no Chrome, Chromium, Brave or Edge found; install one or set CHROME_PATH")
+    profile = os.path.expanduser("~/.ohmyjev/browser")
+    os.makedirs(profile, exist_ok=True)
+    port_file = os.path.join(profile, "DevToolsActivePort")
+    if os.path.exists(port_file): os.remove(port_file)
+    proc = subprocess.Popen([exe, "--headless=new", "--remote-debugging-port=0", "--user-data-dir=" + profile,
+        "--no-first-run", "--no-default-browser-check", "--window-size=1120,780", "about:blank"],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    for _ in range(150):
+        if os.path.exists(port_file) and open(port_file).read().strip(): break
+        time.sleep(0.05)
+    else:
+        proc.kill(); raise RuntimeError("the headless browser did not start: " + exe)
+    os.environ["BU_CDP_URL"] = "http://127.0.0.1:" + open(port_file).read().split()[0]
+    return proc
+
+def pick_value(context):
+    # No text model: Jev picks, from the values the coding agent gave, the one this field needs.
+    from jev_ultrafast.model import post_json
+    values = json.loads(os.environ.get("OMJ_BROWSE_VALUES") or "[]")
+    criteria = {f"v{i}": v for i, v in enumerate(values)}
+    criteria["none"] = "None of these is what this field needs"
+    started = time.time()
+    body = {"model": os.environ.get("TYPESAFE_MODEL", "jev-latest"), "state": context, "questions": {"value": {
+        "type": "choice", "instructions": "Which value should be typed into \`field\` to make progress on \`goal\`?", "criteria": criteria}}}
+    answer = post_json("https://api.typesafe.ai/v1/systemone", os.environ["TYPESAFE_API_KEY"], body)["answers"]["value"]["choice"]
+    if answer not in criteria or answer == "none":
+        raise ValueError("no given value fits the field " + json.dumps(context["field"].get("label")) + "; pass the text it needs in values")
+    return criteria[answer], {"model": "jev (picked from values)", "latency_ms": round((time.time() - started) * 1000), "usage": {}}
+
+proc = None
+try:
+    if not (os.environ.get("BU_CDP_URL") or os.environ.get("BU_CDP_WS")): proc = headless()
+    from jev_ultrafast import Agent
+    import jev_ultrafast.agent
+    if not os.environ.get("TEXT_MODEL_API_KEY"): jev_ultrafast.agent.field_text = pick_value
+    with Agent(sys.argv[1], sys.argv[2]) as agent:
+        for _ in agent.run():
+            pass
+        s = agent.snapshot()
+except Exception as e:
+    print(json.dumps({"error": str(e)[:500]})); sys.exit(0)
+finally:
+    if proc: proc.terminate()
+p = s["page"]
+steps = [h["kind"] + " " + h["action"] + (" = " + h["text"] if h["text"] else "") for h in s["history"]]
+print(json.dumps({"status": s["status"], "url": p.get("url"), "title": p.get("title"), "steps": steps, "ms": s["elapsed_ms"], "text": (p.get("text") or "")[:6000]}))
+`
+
+/**
+ * The process that runs a browse call, or the error to hand back. jev-ultrafast speaks only TypeSafe's endpoint, and
+ * types into fields with a small text model: TEXT_MODEL_API_KEY, else OPENROUTER_API_KEY with mercury-2.5.
+ */
+export function browseCommand(
+  input: { url?: unknown; goal?: unknown; values?: unknown },
+  c: Config,
+  env: Readonly<Record<string, string | undefined>>,
+): { argv: string[]; env: Record<string, string> } | string {
+  const url = typeof input.url === 'string' ? input.url.trim() : ''
+  const goal = typeof input.goal === 'string' ? input.goal.trim() : ''
+  if (!/^https?:\/\/\S+$/i.test(url)) return 'url must be an http(s) URL'
+  if (!goal) return 'goal is required'
+  const typesafe = c.apiKey || env.TYPESAFE_API_KEY
+  if (!typesafe) return 'browse needs a TypeSafe key (TYPESAFE_API_KEY or the apiKey setting); OpenRouter does not serve its requests'
+  const text: Record<string, string> = env.TEXT_MODEL_API_KEY
+    ? { TEXT_MODEL_API_KEY: env.TEXT_MODEL_API_KEY }
+    : env.OPENROUTER_API_KEY
+      ? { TEXT_MODEL_API_KEY: env.OPENROUTER_API_KEY, TEXT_MODEL_BASE_URL: 'https://openrouter.ai/api/v1', TEXT_MODEL: 'inception/mercury-2.5', TEXT_MODEL_REASONING: 'none' }
+      : {}
+  return {
+    argv: ['uv', 'run', '--no-project', '--quiet', '--with', JEV_ULTRAFAST, 'python', '-c', BROWSE_PY, url, goal],
+    env: { TYPESAFE_API_KEY: typesafe, ...text, ...(Array.isArray(input.values) ? { OMJ_BROWSE_VALUES: JSON.stringify(input.values.filter(v => typeof v === 'string').slice(0, 20)) } : {}) },
+  }
+}
+
+/** The runner's stdout as the tool's text: its JSON line, or an error that says what to fix. */
+export function browseReply(stdout: string, stderr = ''): string {
+  const line = stdout.trim().split('\n').at(-1) ?? ''
+  try {
+    const out = JSON.parse(line) as { error?: string }
+    if (out.error && /TEXT_MODEL_API_KEY/.test(out.error)) out.error += '. Pass the text to type in values, or set OPENROUTER_API_KEY'
+    return JSON.stringify(out)
+  } catch {
+    const why = /No such file|ENOENT|not found/i.test(stderr) ? 'uv is not installed (https://docs.astral.sh/uv)' : clip(stderr.trim() || 'no output', 500)
+    return JSON.stringify({ error: `browse could not run: ${why}. Chrome needs remote debugging allowed the first time.` })
+  }
+}
+
+// --- output trim: a long tool output cut to the parts the request needs ---
+
+const TRIM_CHUNK = 1500
+const TRIM_CHUNKS = 24
+
+/** The output in line-aligned chunks of about TRIM_CHUNK characters, at most TRIM_CHUNKS of them; none when short. */
+export function trimChunks(output: string, c: Config): string[] {
+  if (!c.trimOutput || output.length <= c.trimOver) return []
+  const chunks: string[] = []
+  let cur = ''
+  for (const line of output.split('\n')) {
+    if (cur && cur.length + line.length + 1 > TRIM_CHUNK) {
+      chunks.push(cur)
+      cur = ''
+    }
+    cur = cur ? `${cur}\n${line}` : line
+  }
+  if (cur) chunks.push(cur)
+  return chunks.length >= 4 && chunks.length <= TRIM_CHUNKS ? chunks : []
+}
+
+/** One question per chunk, all in one Jev call; the first and last chunks are always kept and not asked about. */
+export function trimRequest(request: string, chunks: string[]) {
+  const middle = chunks.slice(1, -1)
+  const questions: Questions = Object.fromEntries(middle.map((_, i) => [`c${i + 1}`, noul(
+    `Does \`chunks.c${i + 1}\` hold something \`request\` needs: an error, a failing test, a result, or the data asked for?`,
+    'An error or warning, a failure, a value or line the request is about',
+    'Progress lines, passing items, boilerplate or data unrelated to the request',
+  )]))
+  return { state: { request: clip(request, 1500), chunks: Object.fromEntries(middle.map((t, i) => [`c${i + 1}`, t])) }, questions }
+}
+
+/** The output with the chunks Jev rated unrelated replaced by one line each run; null when too little would go. */
+export function trimmed(chunks: string[], a: Answers, c: Config): string | null {
+  const keep = chunks.map((_, i) => i === 0 || i === chunks.length - 1 || nv(a, `c${i}`) >= c.trimKeep)
+  const total = chunks.reduce((n, t) => n + t.length, 0)
+  const kept = chunks.reduce((n, t, i) => n + (keep[i] ? t.length : 0), 0)
+  if (kept > total * 0.7) return null
+  const out: string[] = []
+  for (let i = 0; i < chunks.length; i++) {
+    if (keep[i]) out.push(chunks[i]!)
+    else if (keep[i - 1] !== false) {
+      let lines = 0
+      for (let j = i; j < chunks.length && !keep[j]; j++) lines += chunks[j]!.split('\n').length
+      out.push(`[ohmyjev: ${lines} lines left out as unrelated to the request. Rerun the command with grep or sed -n to see them.]`)
+    }
+  }
+  return out.join('\n')
+}
+
+// --- skill picker: the skill listing out of the prompt, Jev naming the one skill a request needs ---
+
+export type Skill = { name: string; description: string }
+
+/** One request: which skill fits, and three questions about whether the request needs one at all (TypeSafe's cookbook). */
+export const skillQuestions = (skills: readonly Skill[]): Questions => ({
+  which: choice('Which skill in the list best fits `request`?', Object.fromEntries(skills.slice(0, 100).map(s => [s.name, clip(s.description, 300) || s.name]))),
+  acts_on_user_system: noul('Is the assistant asked to act on the user\'s files, accounts, devices or services, rather than only to explain or advise?'),
+  would_follow_documented_procedure: noul('Would a careful expert follow a specific documented procedure or set of commands, rather than answer from general understanding?'),
+  prose_suffices: noul('Could a knowledgeable generalist fully satisfy `request` in prose, with no tools and no access to the user\'s files?'),
+})
+
+/** The skill to name, when the request needs one (the gate's mean) and Jev's pick is clear enough; else null. */
+export function pickSkill(a: Answers, c: Config): { name: string; gate: number; confidence: number } | null {
+  const gate = (nv(a, 'acts_on_user_system') + nv(a, 'would_follow_documented_procedure') + (1 - nv(a, 'prose_suffices'))) / 3
+  const w = ch(a, 'which')
+  if (!w || gate < c.skillGate || w.confidence < c.skillMin) return null
+  return { name: w.choice, gate, confidence: w.confidence }
+}
+
+/** The second request: does the picked skill do the specific thing asked? It can say no, so an only option isn't forced. */
+export const fitsQuestion = (s: Skill): Questions => ({
+  fits: noul(
+    `Does the skill "${s.name}" (${clip(s.description, 600)}) do the specific thing \`request\` asks for?`,
+    'It is the documented procedure for exactly this task',
+    'It is about something else, only nearby, or the request needs no procedure',
+  ),
+})
+export const skillFits = (a: Answers, c: Config): boolean => nv(a, 'fits') >= c.skillGate
+
+export const skillNote = (name: string): string =>
+  `<skill_relevance>\nRelevant to the current request: the ${name} skill. Load it with the Skill tool (${name}) before you start, and ` +
+  'follow it. Ignore this if it does not fit what the user actually asked for.\n</skill_relevance>'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",
@@ -136,6 +136,61 @@
         "description": "Deny when Jev rates a call as sending local data out at least this probably (0-1)",
         "default": 0.7
       },
+      "autoApprove": {
+        "type": "boolean",
+        "description": "Where the host would ask you, run a command or in-repo edit Jev is sure is safe instead",
+        "default": true
+      },
+      "approveConfidence": {
+        "type": "number",
+        "description": "How sure Jev must be that a command only reads or is reversible (0-1)",
+        "default": 0.9
+      },
+      "approveRiskMax": {
+        "type": "number",
+        "description": "Destructive, data-leaving or credential probability under which a call is approved (0-1)",
+        "default": 0.2
+      },
+      "stuckCheck": {
+        "type": "boolean",
+        "description": "After repeated failed calls, ask Jev whether the agent is stuck on one approach and tell it to change course",
+        "default": true
+      },
+      "stuck": {
+        "type": "number",
+        "description": "How sure Jev must be that the failures repeat one approach before the note (0-1)",
+        "default": 0.7
+      },
+      "trimOutput": {
+        "type": "boolean",
+        "description": "Cut a long shell output to the parts your request needs, Jev rating each part",
+        "default": true
+      },
+      "trimOver": {
+        "type": "number",
+        "description": "Characters of shell output before trimming is considered",
+        "default": 12000
+      },
+      "trimKeep": {
+        "type": "number",
+        "description": "How likely Jev must rate a part as needed for it to stay (0-1)",
+        "default": 0.3
+      },
+      "skillPick": {
+        "type": "boolean",
+        "description": "Claude Code only: leave the skill listing out of every prompt; Jev names the one skill a request needs",
+        "default": true
+      },
+      "skillGate": {
+        "type": "number",
+        "description": "Claude Code only: how strongly Jev must rate a request as needing a skill (0-1)",
+        "default": 0.3
+      },
+      "skillMin": {
+        "type": "number",
+        "description": "Claude Code only: how sure Jev must be of which skill fits (0-1)",
+        "default": 0.4
+      },
       "requested": {
         "type": "number",
         "description": "A gate's Jev deny passes when Jev rates your latest message as asking for exactly that call at least this probable (0-1). Policy and path denies always stand",
@@ -146,6 +201,11 @@
         "description": "Expose the ask_jev tool for quick judgments about repo files or text",
         "default": true
       },
+      "browse": {
+        "type": "boolean",
+        "description": "Expose a browse tool: jev-ultrafast does a task in your Chrome, Jev picking each step. Needs uv, Chrome remote debugging, and OPENROUTER_API_KEY to type into fields",
+        "default": false
+      },
       "autoCompact": {
         "type": "boolean",
         "description": "Compact after Jev sees a task change at a natural boundary",