ohmyjev 0.8.0 → 0.9.0

package/README.md

@@ -13,8 +13,8 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ```
 
 <p align="center">
-  Guardrails for Claude Code, Codex, pi and omp, decided by <a href="https://typesafe.ai">Jev</a>.<br>
-  One mod that stops irreversible and data-leaking commands, even in bypass mode, and runs them when you say yes. It also flags prompt injection, pushes back on an unverified "done" and routes effort per turn.
+  <a href="https://typesafe.ai">Jev</a>, batteries included, for Claude Code, Codex, pi and omp.<br>
+  One install that makes your coding agent faster and safer: no permission prompts for safe commands, long output cut to what matters, the right skill loaded, and nothing irreversible until you say yes.
 </p>
 
 <p align="center">
@@ -40,13 +40,14 @@ d88P  88888888 "Y88P"  888  888 888  888  888  "Y88888   888  "Y8888    Y88P
 ---
 
 Jev is TypeSafe's decision model. You send it some state and a few typed questions, and it sends back probabilities
-in about 300 ms for a fraction of a cent. That's fast and cheap enough to ask about every command your agent runs, so
-ohmyjev does exactly that. It runs as in-process hooks inside Claude Code, which means no extra process and no server
-to keep up.
+in about 200 ms for a fraction of a cent. That's cheap enough to ask about every step your agent takes, so ohmyjev asks
+it everywhere a coding agent wastes your time or puts your work at risk: which command needs your OK, which part of a
+long log matters, which skill a prompt needs, whether the agent is going in circles, and whether a command can be
+undone. It runs as in-process hooks, so there's no extra process and no server to keep up.
 
-The bash gate is the core. An agent running unattended in bypass mode can't wipe a directory, force push over `main` or
-upload your keys, and it never stops to ask you for permission. When it blocks something, the agent tells you why and
-asks. Answer yes and that exact command runs. Everything else here builds on the same cheap, per-call judgment.
+Most of it makes the agent faster. The bash gate keeps it safe: an agent running unattended in bypass mode can't wipe a
+directory, force push over `main` or upload your keys. When it blocks something, the agent tells you why and asks.
+Answer yes and that exact command runs.
 
 ## Quick start
 
@@ -65,6 +66,19 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 
 ## What you get
 
+### Faster
+
+| Feature | What it does |
+|---|---|
+| **Auto-approve** | Where Claude Code or Codex would stop to ask you, a command Jev is sure only reads or can be undone, or an edit inside the repo with no credential in it, runs without the prompt. Plain reads like `ls`, `git status` and `grep` are cleared by code, with no Jev call at all. Off whenever you've set `policies`. |
+| **Trim long output** | A shell output over 12000 characters is split into parts, and one Jev call rates which parts your request needs: the error, the failing test, the value you asked for. The rest becomes one line saying how much was left out. A 20000-character test log came back as 4600 with the one failure in it. |
+| **Skill picker** | Claude Code sends the model a line for every skill you have on every prompt. ohmyjev leaves that list out and asks Jev whether a prompt needs a skill and which one, then names it beside your prompt. A second check makes sure the pick does the job, so a prompt no skill fits gets none. |
+| **Stuck check** | After the third failed tool call in a request, Jev reads the failures. If they repeat one approach and fail the same way, the agent is told to stop, read the error and try something else, or ask you. |
+| **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
+| **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
+
+### Safer
+
 | Feature | What it does |
 |---|---|
 | **Bash gate** | Denies a command when Jev rates it irreversible at 0.6 or more, or when it sends local files or secrets to an outside host (0.7), such as `curl` uploading `~/.ssh`. A command Jev calls irreversible with less confidence is denied too when it also aims to wipe something (0.7). Reversible work always passes, so deleting lines, dropping a co-author trailer or uninstalling a plugin goes through. Plain reads like `ls`, `git status` or `grep` skip Jev entirely: plain code checks them, so they cost nothing and wait for nothing. |
@@ -74,8 +88,11 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 | **Your request** | Every gate also asks Jev whether your latest message asked for exactly this call. If it did (0.8), a gate's Jev deny lets the call through. So "delete the build folder" or "force push it" works, while the same command picked by the agent on its own is still denied. After a block, a plain "yes" works too: the gate shows Jev the call it just blocked next to your reply. Policy and path denies always stand. |
 | **Injection screen** | When output from Bash, WebFetch, an MCP tool, or a Read outside the repo has instructions aimed at the model, it adds a note telling the model to treat that output as data. |
 | **Done-check** | If the agent says it's done but nothing shows it ran a check, it blocks the stop once and tells the agent to verify. A turn that ran no tools is never blocked, since there was nothing to verify. |
-| **Router** | Asks Jev once per request for a tier, an effort level and a risk score. Then it raises or lowers effort and picks the model for general-purpose subagents. With no key it falls back to Claude Code's built-in classifier, which reports no confidence, so then it only ever routes up. |
-| **Auto-compact** | When the task changes after a finished step and the context is at least 40% full, it compacts the conversation. The summary keeps the new request in full. |
+
+### Tools and commands
+
+| Feature | What it does |
+|---|---|
 | **`ask_jev`** | A tool the model can use to ask Jev about repo files or text without loading them into its own context. |
 | **`browse`** | A tool that does a web task in a headless browser, with Jev picking each click and field: a Google Flights search in about 6 seconds. Off until you turn on `browse`. |
 | **`/omj`** | This session's Jev calls, errors, cost, median latency and denies, and where the key comes from. It never prints the key. `/omj config` lists and changes settings. `/omj stats` opens a dashboard of every session in your browser. `/omj off` and `/omj on` switch ohmyjev for the session. `/ohmyjev` is the same command. |
@@ -86,18 +103,21 @@ If `/omj` ends with `key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0`, you'r
 flowchart LR
     A[Claude calls a tool] --> B{ohmyjev asks Jev}
     B -- clearly risky --> C[Denied, with the reason]
+    B -- clearly safe --> E
     B -- fine or unsure --> D[Claude Code's normal permission flow]
     B -- Jev down, slow or no key --> D
     D --> E[Tool runs]
-    E --> F{Output has instructions<br>aimed at the model?}
+    E --> T[Long output trimmed<br>to what the request needs]
+    T --> F{Output has instructions<br>aimed at the model?}
     F -- yes --> G[Model gets a<br>'treat as data' note]
     F -- no --> H[Output as is]
 ```
 
-Anything ohmyjev doesn't deny just goes on to Claude Code's normal permission flow. That covers middling answers, Jev
-being down or slower than `timeoutMs` (1.5 s), a missing key, and any error inside ohmyjev. It never stops to ask you to approve
-anything, so it works fine with agents running in bypass mode. Jev can be wrong though, so keep your deny rules in
-`settings.json`.
+Anything ohmyjev neither denies nor clears goes on to Claude Code's normal permission flow. That covers middling
+answers, Jev being down or slower than `timeoutMs` (1.5 s), a missing key, and any error inside ohmyjev. It never adds a
+prompt of its own, so it works fine with agents running in bypass mode. It only removes prompts: auto-approve answers
+"allow" only where the engine was about to ask and your settings left the call open. Jev can be wrong though, so keep
+your deny rules in `settings.json`.
 
 ## Install
 
@@ -160,8 +180,9 @@ codex plugin add ohmyjev@ohmyjev
 ```
 
 Then start Codex and run `/hooks` once: Codex skips a plugin's hooks until you trust them. ohmyjev needs Node on your
-`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, screens their
-output, and runs the done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
+`PATH` and the key in the shell that starts Codex. It gates `Bash`, `apply_patch` edits and MCP calls, answers
+Codex's permission prompts for calls Jev cleared, trims long output, screens it, catches repeated failures, and runs the
+done-check. Saying yes after a block works the same way. Codex hooks can't change the model or add
 a tool, so there is no router, no `ask_jev` and no `/omj` command. Put settings in `~/.codex/ohmyjev.json`, using the
 names in [Settings](#settings):
 
@@ -210,6 +231,10 @@ pi has no settings screen for extensions, so put yours under an `ohmyjev` key in
 | Exfil gate | WebFetch, MCP tools | MCP tools | `read` of a URL, MCP tools | MCP tools (pi has no fetch tool; `curl` goes through the bash gate) |
 | Injection screen | Bash, WebFetch, MCP, Reads outside the repo | Bash, MCP | `bash`, `github`, URL reads, MCP, reads outside the repo | `bash`, `powershell`, MCP, reads outside the repo |
 | Done-check | ✓ | ✓ | ✓ | ✓ |
+| Auto-approve | ✓ | ✓ (PermissionRequest) | none: omp doesn't ask | none: pi doesn't ask |
+| Trim long output | Bash | Bash (the trimmed text replaces the result) | `bash` | `bash`, `powershell` |
+| Stuck check | ✓ | ✓ | ✓ | ✓ |
+| Skill picker | ✓ | none: hooks can't remove the skill list | none | none |
 | Router effort | ✓ | none: hooks can't set it | ✓ (left alone while you're on `auto`) | ✓ |
 | Router subagent model | general-purpose subagents | none | subagents on the default `task` role | none: pi has no subagents |
 | Router without a key | Claude Code's built-in classifier, up only | none | off: omp has no separate classifier call for extensions | the cheapest model you've set up, up only |
@@ -380,6 +405,10 @@ one for the session. To keep a change, run `/plugin configure ohmyjev@ohmyjev` i
 | `autoCompact` | on | Compacts when the task changes. `compactMinPercent` (40) sets how full the context has to be first. |
 | `askJev` | on | Gives the model the `ask_jev` tool. |
 | `browse` | off | Gives the model the `browse` tool. Needs uv and a Chromium-based browser. |
+| `autoApprove` | on | Skips the permission prompt for a call Jev is sure is safe. `approveConfidence` (0.9) and `approveRiskMax` (0.2) set how sure. |
+| `trimOutput` | on | Cuts long shell output to what the request needs. `trimOver` (12000 characters) and `trimKeep` (0.3) tune it. |
+| `stuckCheck` | on | Tells the agent to change course when its failures repeat. `stuck` (0.7) sets how sure Jev must be. |
+| `skillPick` | on | Claude Code: leaves the skill list out and names the one skill a prompt needs. `skillGate` (0.3) and `skillMin` (0.4) tune it. |
 | `policies` | empty | Your own rules, separated by `;`. |
 | `allowPaths` | `~/.claude;$TMPDIR;/tmp` | Places outside the repo where writes are allowed. ohmyjev ignores any entry with `..` in it. You don't need it for a sibling worktree or another git repo the agent `cd`s into: those count as the repo. |
 | `fastModel`, `balancedModel`, `deepModel` | `claude-haiku-5-5`, `claude-sonnet-5-5`, `claude-opus-5-5` | The model id for each router tier. |
@@ -410,6 +439,9 @@ a fixed size:
 | Injection screen | The tool's output (up to 6000 characters), from Bash, WebFetch, MCP tools and Reads outside the repo |
 | Done-check | The current request (600), up to five earlier requests (200 each), up to 20 of this turn's tool calls with their input (200 each) and outcome, and Claude's last message (1500) |
 | Router | The request (up to 1500 characters) |
+| Trim long output | Your latest message (1500) and the long output, in parts of about 1500 characters, up to 24 parts |
+| Stuck check | Your latest message (600) and the last six failed calls: each one's input and the end of its output (300 each) |
+| Skill picker | Each prompt (1500) with every skill's name and one-line description (300 each); then the picked skill's description (600) |
 | `ask_jev` | The model's question, any text it passes (up to 20000 characters) and the repo files it names (8000 each, 80000 in total). It never sends files outside the repo |
 | `browse` | The goal and URL to the exfil gate; then, each step, the page's controls and visible text (6000) and the goal to Jev, and the page's text to the injection screen. The websites see the browser like any visitor |
 

package/adapters/codex.ts

@@ -7,15 +7,17 @@
  */
 import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import {
-  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, callSummary, clip, denyText, gateBash, gateExfil, gateWrite,
+  BASH_Q, EXFIL_Q, SCREEN_Q, STOP_Q, WRITE_Q, applyPatchPaths, approveBash, approveWrite, callSummary, clip, clipTail, denyText, gateBash, gateExfil, gateWrite,
   judgeStop, pathDenyText, plainRead, readConfig, sanitizeSid, screen, withPolicies, withPolicyQ, type Config,
 } from '../hooks/policy.ts'
-import { Session, keyOf, pathAllowed, repoRoot, type Env, type Fetch } from './shared.ts'
+import { Session, keyOf, newStuck, pathAllowed, repoRoot, stuckNote, trimOutput, type Env, type Fetch, type Stuck } from './shared.ts'
 
 const CLIP = 16000
-type Tool = { tool: string; input: string; outcome: 'ok' | 'failed' }
-type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number }
-const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1 }
+type Tool = { tool: string; input: string; outcome: 'ok' | 'failed'; output: string }
+type State = { request: string; previous: string[]; count: number; blockedBefore: string; lastBlocked: string; tools: Tool[]; pushedBackAt: number; approved: string[]; stuck: Stuck }
+const EMPTY: State = { request: '', previous: [], count: 0, blockedBefore: '', lastBlocked: '', tools: [], pushedBackAt: -1, approved: [], stuck: { failures: [], askedAt: 0 } }
+/** A call Jev cleared, as PermissionRequest will see it again. */
+const approvalKey = (tool: string, input: Input): string => `${tool}\u0000${str(input, 'command')}`
 type Input = Record<string, unknown>
 const str = (o: Input, k: string): string => (typeof o[k] === 'string' ? (o[k] as string) : '')
 const obj = (v: unknown): Input => (v && typeof v === 'object' && !Array.isArray(v) ? (v as Input) : {})
@@ -63,7 +65,7 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     const prompt = str(input, 'prompt')
     if (!prompt.trim() || /^\/\S+\s*$/.test(prompt.trim())) return undefined
     if (st.request) st.previous = [...st.previous, clip(st.request, 200)].slice(-5)
-    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [] })
+    Object.assign(st, { request: prompt, count: st.count + 1, blockedBefore: st.lastBlocked, lastBlocked: '', tools: [], stuck: newStuck() })
     await save(env, sid, st)
     return undefined
   }
@@ -73,7 +75,14 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
   const toolInput = obj(input.tool_input)
 
   if (event === 'PreToolUse') {
-    const blocked = async (j: { verdict: unknown; reason: string }) => {
+    const approve = async () => {
+      if (!c.autoApprove) return undefined
+      st.approved = [...st.approved, approvalKey(tool, toolInput)].slice(-20)
+      await save(env, sid, st)
+      return undefined
+    }
+    const blocked = async (j: { verdict: unknown; reason: string }, safe = false) => {
+      if (j.verdict === null && safe) return approve()
       if (j.verdict !== 'deny') return undefined
       st.lastBlocked = callSummary(tool, toolInput)
       await save(env, sid, st)
@@ -81,13 +90,13 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     }
     if (tool === 'Bash' && c.bashGate) {
       const command = str(toolInput, 'command')
-      if (plainRead(command, c)) return undefined
+      if (plainRead(command, c)) return approve()
       const state = withPolicies({ command: clip(command, CLIP), cwd, ...(command.length > CLIP ? { truncated: true } : {}) }, c, st.request, st.blockedBefore)
       const d = await x.decide('tool.call', tool, state, withPolicyQ(BASH_Q, c, st.request))
       if (!d) return undefined
       const j = gateBash(d.answers, c)
       x.record(d, j.verdict, j.reason)
-      return blocked(j)
+      return blocked(j, approveBash(d.answers, c))
     }
     if (tool === 'apply_patch' && c.writeGate) {
       const patch = str(toolInput, 'command')
@@ -102,7 +111,7 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
       if (!d) return undefined
       const j = gateWrite(d.answers, c)
       x.record(d, j.verdict, j.reason)
-      return blocked(j)
+      return blocked(j, approveWrite(d.answers, c))
     }
     if (tool.startsWith('mcp__') && c.exfilGate) {
       const state = withPolicies({ tool, input: clip(JSON.stringify(toolInput), 4000) }, c, st.request, st.blockedBefore)
@@ -115,19 +124,35 @@ export async function handle(input: Input, env: Env, fetchImpl?: Fetch): Promise
     return undefined
   }
 
+  if (event === 'PermissionRequest') {
+    const key = approvalKey(tool, toolInput)
+    if (!c.autoApprove || !st.approved.includes(key)) return undefined
+    st.approved = st.approved.filter(k => k !== key)
+    await save(env, sid, st)
+    return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'allow' } } }
+  }
+
   if (event === 'PostToolUse') {
     const response = input.tool_response
     const code = obj(response).exit_code ?? obj(response).exitCode
-    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok' } as Tool].slice(-20)
+    const r = obj(response)
+    const shown = typeof response === 'string' ? response : typeof r.output === 'string' ? r.output : typeof r.stdout === 'string' ? r.stdout : JSON.stringify(response ?? '')
+    st.tools = [...st.tools, { tool, input: clip(JSON.stringify(toolInput), 200), outcome: typeof code === 'number' && code !== 0 ? 'failed' : 'ok', output: clipTail(shown, 300) } as Tool].slice(-20)
+    const failed = typeof code === 'number' && code !== 0
+    const stuck = failed ? await stuckNote(x, st.stuck, st.request, tool, toolInput, shown) : null
     await save(env, sid, st)
-    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__'))) return undefined
-    const text = typeof response === 'string' ? response : JSON.stringify(response ?? '')
-    if (!text.trim()) return undefined
-    const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
-    if (!d) return undefined
+    const notes = stuck ? [stuck] : []
+    // a cut output replaces the result: Codex hooks can't edit it, but a PostToolUse block's reason stands in for it
+    const cut = tool === 'Bash' ? await trimOutput(x, st.request, shown) : null
+    if (cut) return { decision: 'block', reason: [cut, ...notes].join('\n') }
+    const context = () => (notes.length ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: notes.join('\n') } } : undefined)
+    if (!c.injectionScreen || !(tool === 'Bash' || tool.startsWith('mcp__')) || !shown.trim()) return context()
+    const d = await x.decide('tool.result', tool, { tool, content: clip(shown, 6000) }, SCREEN_Q)
+    if (!d) return context()
     const s = screen(d.answers, c)
     x.record(d, s.flagged ? 'flag' : null, s.reason)
-    return s.flagged ? { hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: s.note } } : undefined
+    if (s.flagged) notes.push(s.note)
+    return context()
   }
 
   if (event === 'Stop') {

package/adapters/omp.ts

@@ -4,13 +4,13 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, DEFAULTS, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand, applyPatchPaths,
+  clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, clipTail, plainRead, configCommand, applyPatchPaths,
   BROWSE_DESCRIPTION, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, modelOf, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, Session, answerAsk, runBrowse, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, Session, answerAsk, newStuck, runBrowse, stuckNote, trimOutput, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -193,16 +193,18 @@ function sameModel(left: HostModel | undefined, right: HostModel | undefined): b
   )
 }
 
-function toolState(messages: unknown[], after: number): Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> {
+function toolState(messages: unknown[], after: number): Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> {
   const tail = messages.slice(after)
   const outcomes = new Map<string, 'ok' | 'failed'>()
+  const outputs = new Map<string, string>()
   for (const message of tail) {
     const m = object(message)
     if (m.role !== 'toolResult') continue
     const id = typeof m.toolCallId === 'string' ? m.toolCallId : ''
     if (id) outcomes.set(id, m.isError === true ? 'failed' : 'ok')
+    if (id) outputs.set(id, clipTail(text(m.content), 300))
   }
-  const calls: Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> = []
+  const calls: Array<{ tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> = []
   for (const message of tail) {
     const m = object(message)
     if (m.role !== 'assistant' || !Array.isArray(m.content)) continue
@@ -214,6 +216,7 @@ function toolState(messages: unknown[], after: number): Array<{ tool: string; in
         tool: typeof p.name === 'string' ? p.name : '',
         input: clip(safeJson(p.arguments), 200),
         outcome: outcomes.get(id) ?? 'pending',
+        output: outputs.get(id) ?? '',
       })
     }
   }
@@ -247,6 +250,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     let liveRequest = ''
     let lastBlocked = '' // the call a gate denied this turn
     let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let stuck = newStuck()
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let classifiedPrompt: string | undefined
@@ -573,23 +577,30 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
     pi.on('tool_result', async (rawEvent, ctx) => {
       try {
         touch(ctx)
-        if (!session || !c.enabled || !c.injectionScreen) return
+        if (!session || !c.enabled) return
         const event = rawEvent as ToolResult
         const tool = event.toolName
         const input = object(event.input)
+        let resultText = event.content.map(part => part.type === 'text' && typeof part.text === 'string' ? part.text : '').filter(Boolean).join('\n')
+        const cut = tool === 'bash' ? await trimOutput(session, userRequest, resultText) : null
+        if (cut) resultText = cut
+        const base = cut ? [...event.content.filter(part => part.type !== 'text'), { type: 'text', text: cut }] : event.content
+        const stuckText = (event as { isError?: boolean }).isError ? await stuckNote(session, stuck, userRequest, tool, input, resultText) : null
+        const content = stuckText ? [...base, { type: 'text', text: stuckText }] : base
+        const changed = stuckText || cut
+        if (!c.injectionScreen) return changed ? { content } : undefined
         let shouldScreen = tool === 'bash' || tool === 'github' || exfilTool(tool, input)
         if (tool === 'read' && !urlRead(tool, input) && c.screenReads) {
           const path = string(input, 'path')
           shouldScreen = !sessionLocalWrite(path) && !(await pathAllowed(path, ctx.cwd, root, c, env))
         }
-        if (!shouldScreen) return
-        const resultText = event.content.map(part => part.type === 'text' && typeof part.text === 'string' ? part.text : '').filter(Boolean).join('\n')
-        if (!resultText.trim()) return
+        if (!shouldScreen || !resultText.trim()) return changed ? { content } : undefined
         const d = await session.decide('tool_result', tool, { tool, content: clip(resultText, 6000) }, SCREEN_Q)
-        if (!d) return
+        if (!d) return changed ? { content } : undefined
         const screened = screen(d.answers, c)
         session.record(d, screened.flagged ? 'flag' : null, screened.reason)
-        if (screened.flagged) return { content: [...event.content, { type: 'text', text: screened.note }] }
+        if (screened.flagged) return { content: [...content, { type: 'text', text: screened.note }] }
+        return changed ? { content } : undefined
       } catch {
         return
       }
@@ -650,6 +661,7 @@ export function createExtension(options: OmpExtensionOptions = {}): (pi: OmpApi)
         userEffort = userThinking(ctx)
         const prompt = typeof rawEvent.prompt === 'string' ? rawEvent.prompt : ''
         if (prompt.trim() && !/^\/\S+\s*$/.test(prompt.trim())) {
+          stuck = newStuck()
           userRequest = prompt
           blockedBefore = lastBlocked
           lastBlocked = ''

package/adapters/pi.ts

@@ -1,13 +1,13 @@
 import { readFile } from 'node:fs/promises'
 import {
   BASH_Q, EXFIL_Q, ROUTE_Q, SCREEN_Q, STOP_Q, SWITCHED_Q, WRITE_Q,
-  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, plainRead, configCommand,
+  TIER_LABELS, builtinRoute, clip, decideRoute, denyText, gateBash, gateExfil, gateWrite, jevRouteLine, judgeStop, pathDenyText, callSummary, clipTail, plainRead, configCommand,
   BROWSE_DESCRIPTION, BROWSE_SCHEMA, OMJ_HELP, OMJ_OFF, OMJ_ON, toggleArg,
   keepInstructions, readConfig, routeStep, screen, stepLine, withPolicies, withPolicyQ,
   type Config, type Route,
 } from '../hooks/policy.ts'
 import {
-  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, runBrowse, keyOf, pathAllowed, repoRoot,
+  ASK_DESCRIPTION, ASK_SCHEMA, Session, answerAsk, newStuck, runBrowse, stuckNote, trimOutput, keyOf, pathAllowed, repoRoot,
   type Env, type Fetch,
 } from './shared.ts'
 
@@ -173,20 +173,23 @@ function messagesForStop(messages: HostMessage[]) {
     }
   }
 
-  const tools: Array<{ id: string; tool: string; input: string; outcome: 'ok' | 'failed' | 'pending' }> = []
+  const tools: Array<{ id: string; tool: string; input: string; outcome: 'ok' | 'failed' | 'pending'; output: string }> = []
   const byId = new Map<string, (typeof tools)[number]>()
   for (const message of messages.slice(lastRequest + 1)) {
     if (message.role === 'assistant' && Array.isArray(message.content)) {
       for (const part of message.content) {
         const block = entry(part)
         if (block.type !== 'toolCall' || typeof block.id !== 'string' || typeof block.name !== 'string') continue
-        const call = { id: block.id, tool: block.name, input: clip(json(block.arguments), 200), outcome: 'pending' as const }
+        const call = { id: block.id, tool: block.name, input: clip(json(block.arguments), 200), outcome: 'pending' as 'ok' | 'failed' | 'pending', output: '' }
         tools.push(call)
         byId.set(call.id, call)
       }
     } else if (message.role === 'toolResult' && typeof message.toolCallId === 'string') {
       const call = byId.get(message.toolCallId)
-      if (call) call.outcome = message.isError ? 'failed' : 'ok'
+      if (call) {
+        call.outcome = message.isError ? 'failed' : 'ok'
+        call.output = clipTail(textOf(message.content), 300)
+      }
     }
   }
 
@@ -196,7 +199,7 @@ function messagesForStop(messages: HostMessage[]) {
     state: {
       current_request: clip(textOf(requests.at(-1)?.content), 600),
       previous_requests: requests.slice(-6, -1).map(message => clip(textOf(message.content), 200)),
-      tools_this_turn: tools.slice(-20).map(({ tool, input, outcome }) => ({ tool, input, outcome })),
+      tools_this_turn: tools.slice(-20).map(({ tool, input, outcome, output }) => ({ tool, input, outcome, output })),
       last_assistant_message: clip(textOf(lastAssistant?.content), 1500),
     },
   }
@@ -259,6 +262,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
     let liveRequest = ''
     let lastBlocked = '' // the call a gate denied this turn
     let blockedBefore = '' // what was denied in the turn before this request: a "yes" confirms it
+    let stuck = newStuck()
     let userRequest = '' // the user's latest message: the gates ask whether it asked for the call
     let compactPending = false
     let userThinking: ThinkingLevel = 'medium'
@@ -439,6 +443,7 @@ export function createExtension(options: PiAdapterOptions = {}) {
     pi.on('before_agent_start', guarded<BeforeAgentStartEvent, void>(async (event, ctx) => {
       latestCtx = ctx
       if (event.prompt.trim() && !/^\/\S+\s*$/.test(event.prompt.trim())) {
+        stuck = newStuck()
         userRequest = event.prompt
         blockedBefore = lastBlocked
         lastBlocked = ''
@@ -519,27 +524,38 @@ export function createExtension(options: PiAdapterOptions = {}) {
       }
     }))
 
-    pi.on('tool_result', guarded<ToolResultEvent, { content: Content[]; structuredContent?: unknown }>(async (event, ctx) => {
+    pi.on('tool_result', guarded<ToolResultEvent, { content: Content[]; structuredContent?: unknown }>(async (evt, ctx) => {
+      let event = evt
       latestCtx = ctx
       if (!c.enabled) return
       const tool = event.toolName
       const shell = tool === 'bash' || tool === 'powershell'
-      if (!c.injectionScreen || (event.isError && !shell)) return
+      let text = event.content.filter((part): part is TextContent => part.type === 'text').map(part => part.text).join('\n')
+      const cut = shell ? await trimOutput(await ensureSession(ctx), userRequest, text) : null
+      if (cut) {
+        text = cut
+        event = { ...event, content: [...event.content.filter(part => part.type !== 'text'), { type: 'text', text: cut }] }
+      }
+      const stuckText = event.isError ? await stuckNote(await ensureSession(ctx), stuck, userRequest, tool, event.input, text) : null
+      const withStuck = stuckText
+        ? { content: [...event.content, { type: 'text' as const, text: stuckText }], ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}) }
+        : undefined
+      const changed = withStuck ?? (cut ? { content: event.content, ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}) } : undefined)
+      if (!c.injectionScreen || (event.isError && !shell)) return changed
       const candidate = shell || tool.startsWith('mcp__') || tool === 'read'
-      if (!candidate) return
+      if (!candidate) return changed
       if (tool === 'read') {
-        if (!c.screenReads || await pathAllowed(arg(event.input, 'path'), ctx.cwd, root, c, env)) return
+        if (!c.screenReads || await pathAllowed(arg(event.input, 'path'), ctx.cwd, root, c, env)) return changed
       }
-      const content = event.content.filter((part): part is TextContent => part.type === 'text').map(part => part.text).join('\n')
-      if (!content.trim()) return
+      if (!text.trim()) return changed
       const x = await ensureSession(ctx)
-      const d = await x.decide('tool.result', tool, { tool, content: clip(content, 6000) }, SCREEN_Q)
-      if (!d) return
+      const d = await x.decide('tool.result', tool, { tool, content: clip(text, 6000) }, SCREEN_Q)
+      if (!d) return changed
       const judged = screen(d.answers, c)
       x.record(d, judged.flagged ? 'flag' : null, judged.reason)
-      if (!judged.flagged) return
+      if (!judged.flagged) return changed
       return {
-        content: [...event.content, { type: 'text', text: judged.note }],
+        content: [...(changed?.content ?? event.content), { type: 'text', text: judged.note }],
         ...(Object.hasOwn(event, 'structuredContent') ? { structuredContent: event.structuredContent } : {}),
       }
     }))

package/adapters/shared.ts

@@ -9,7 +9,7 @@ import { dashboardHtml } from '../hooks/dashboard.ts'
 import { ENDPOINTS, JevError, parseReply, pickKey, type Key } from '../hooks/jev.ts'
 import {
   BROWSE_TIMEOUT_MS, DASHBOARD, EMPTY_SESSION, EXFIL_Q, SCREEN_Q, browseCommand, browseReply, denyText, gateExfil, screen, withPolicies, withPolicyQ, absolute, buildQuestion, clip, expandRoot, hostPath, isUnder, normalize, parseLog, parseWorktrees, rawAbsolute, sanitizeSid,
-  splitList, statusText, summarize, type Answers, type Config, type LogEntry, type Questions, type SessionState, type Verdict,
+  STUCK_Q, trimChunks, trimRequest, trimmed, failureOf, judgeStuck, stuckDue, stuckState, splitList, statusText, summarize, type Failure, type Answers, type Config, type LogEntry, type Questions, type SessionState, type Verdict,
 } from '../hooks/policy.ts'
 
 export type Env = Readonly<Record<string, string | undefined>>
@@ -333,3 +333,37 @@ export async function runBrowse(
   x.record(d, s.flagged ? 'flag' : null, s.reason)
   return { text: s.flagged ? `${text}\n${s.note}` : text }
 }
+
+// --- stuck check: the same approach failing over and over ---
+
+/** One request's failed calls; reset it when the user sends a new request. */
+export type Stuck = { failures: Failure[]; askedAt: number }
+export const newStuck = (): Stuck => ({ failures: [], askedAt: 0 })
+
+/** Records a failed call and, when due, asks Jev whether the attempts repeat: the note for the model, or null. */
+export async function stuckNote(x: Session, st: Stuck, request: string, tool: string, input: unknown, output: unknown): Promise<string | null> {
+  if (!x.c.enabled || !x.c.stuckCheck) return null
+  st.failures.push(failureOf(tool, input, output))
+  if (!stuckDue(st.failures.length, st.askedAt)) return null
+  st.askedAt = st.failures.length
+  const d = await x.decide('tool.result', 'stuck', stuckState(request, st.failures), STUCK_Q)
+  if (!d) return null
+  const note = judgeStuck(d.answers, x.c, st.failures.length)
+  x.record(d, note ? 'flag' : null, note ? 'stuck' : 'not stuck')
+  return note
+}
+
+// --- output trim ---
+
+/** A long shell output cut to the parts the request needs; null to keep it whole. */
+export async function trimOutput(x: Session, request: string, output: string): Promise<string | null> {
+  if (!x.c.enabled) return null
+  const chunks = trimChunks(output, x.c)
+  if (!chunks.length) return null
+  const { state, questions } = trimRequest(request, chunks)
+  const d = await x.decide('tool.result', 'trim', state, questions)
+  if (!d) return null
+  const out = trimmed(chunks, d.answers, x.c)
+  x.record(d, null, out ? `trimmed ${output.length} to ${out.length} characters` : 'kept whole')
+  return out
+}

package/hooks/policy.ts

@@ -25,6 +25,17 @@ export const DEFAULTS = {
   doneAsksUserMax: 0.5,
   exfil: 0.7,
   requested: 0.8,
+  autoApprove: true,
+  stuckCheck: true,
+  skillPick: true,
+  skillGate: 0.3,
+  skillMin: 0.4,
+  trimOutput: true,
+  trimOver: 12000,
+  trimKeep: 0.3,
+  stuck: 0.7,
+  approveConfidence: 0.9,
+  approveRiskMax: 0.2,
   askJev: true,
   browse: false,
   autoCompact: true,
@@ -185,12 +196,33 @@ export const STOP_Q: Questions = {
   claimed_done: noul('Does `last_assistant_message` say the task in `current_request` is complete?'),
   verified: noul(
     'Is there evidence the work was checked?',
-    'Tests, a build or the program ran and did not fail, output was quoted or inspected; `tools_this_turn` shows such a check with outcome ok',
+    'Tests, a build or the program ran and did not fail, output was quoted or inspected; `tools_this_turn` shows such a check with outcome ok and an `output` that confirms it',
     'Only claims success, edited without running or inspecting anything, or every check is pending, backgrounded or failed',
   ),
   asks_user: noul('Does `last_assistant_message` end by asking the user a question or reporting a blocker it cannot resolve?'),
   at_boundary: noul('Did the last turn finish a unit of work rather than stop mid-step?'),
 }
+export const STUCK_Q: Questions = {
+  stuck: noul(
+    'Do the attempts in `failures` repeat one approach and fail the same way, so trying it again will not help?',
+    'The same command, edit or fix, re-run with small changes, and the same error or the same kind of failure each time',
+    'Different approaches, different errors, or each attempt gets further than the last',
+  ),
+}
+/** A failed tool call, as the stuck check reads it. */
+export type Failure = { tool: string; input: string; output: string }
+export const failureOf = (tool: string, input: unknown, output: unknown): Failure =>
+  ({ tool, input: clip(typeof input === 'string' ? input : JSON.stringify(input), 300), output: clipTail(output, 300) })
+/** Ask after the third failure in a request, then after every third more: rarely, and only while it keeps failing. */
+export const stuckDue = (failures: number, askedAt: number): boolean => failures >= 3 && failures - askedAt >= 3
+export const stuckState = (request: string, failures: Failure[]) => ({ current_request: clip(request, 600), failures: failures.slice(-6) })
+export function judgeStuck(a: Answers, c: Config, n: number): string | null {
+  const p = nv(a, 'stuck')
+  return p >= c.stuck
+    ? `[ohmyjev] The last ${n} failed attempts repeat one approach and fail the same way (${f2(p)}). Stop repeating it: read the error, try a different approach, or ask the user.`
+    : null
+}
+
 export const SWITCHED_Q: Questions = {
   switched_gears: noul('Is `current_request` a different task from `previous_requests`, so the earlier work is no longer needed?'),
 }
@@ -204,6 +236,11 @@ export const clip = (text: unknown, n: number): string => {
   const s = typeof text === 'string' ? text : ''
   return s.length <= n ? s : s.slice(0, n - 1) + '…'
 }
+/** The end of a tool's output, where a test run's verdict and an error's last line are. */
+export const clipTail = (text: unknown, n: number): string => {
+  const s = typeof text === 'string' ? text.trim() : ''
+  return s.length <= n ? s : '…' + s.slice(-(n - 1))
+}
 export const sanitizeSid = (sid: string): string => sid.replace(/[^\w-]/g, '') || 'unknown'
 export const denyText = (reason: string): string => `ohmyjev blocked this: ${reason}. ${BLOCK_NOTICE}`
 /** A path deny is a setting, not a hazard: the model must not route around it, but it should tell the user how to widen it. */
@@ -288,6 +325,21 @@ export function gateBash(a: Answers, c: Config): Judged {
   return { verdict: null, reason: `${effect.choice} (${f2(effect.confidence)}), destructive ${f2(destructive)}, exfil ${f2(out)}` }
 }
 
+/**
+ * Whether the host may skip asking the person: Jev is sure the command only reads or makes a change git or a reinstall
+ * undoes, and sees no wipe and no data leaving. Policies make every call worth a look, so nothing is approved then.
+ */
+export function approveBash(a: Answers, c: Config): boolean {
+  const effect = ch(a, 'effect')
+  return c.autoApprove && !splitList(c.policies).length && effect.choice !== 'irreversible' && effect.confidence >= c.approveConfidence &&
+    nv(a, 'destructive_intent') < c.approveRiskMax && nv(a, 'exfiltrates') < c.approveRiskMax
+}
+/** The same for an edit inside the repo: no credential in it, not a secrets file. */
+export function approveWrite(a: Answers, c: Config): boolean {
+  const kind = ch(a, 'kind')
+  return c.autoApprove && !splitList(c.policies).length && nv(a, 'contains_secret') < c.approveRiskMax && kind.choice !== 'secrets'
+}
+
 export function gateWrite(a: Answers, c: Config): Judged {
   const kind = ch(a, 'kind')
   const secret = nv(a, 'contains_secret')
@@ -723,3 +775,87 @@ export function browseReply(stdout: string, stderr = ''): string {
     return JSON.stringify({ error: `browse could not run: ${why}. Chrome needs remote debugging allowed the first time.` })
   }
 }
+
+// --- output trim: a long tool output cut to the parts the request needs ---
+
+const TRIM_CHUNK = 1500
+const TRIM_CHUNKS = 24
+
+/** The output in line-aligned chunks of about TRIM_CHUNK characters, at most TRIM_CHUNKS of them; none when short. */
+export function trimChunks(output: string, c: Config): string[] {
+  if (!c.trimOutput || output.length <= c.trimOver) return []
+  const chunks: string[] = []
+  let cur = ''
+  for (const line of output.split('\n')) {
+    if (cur && cur.length + line.length + 1 > TRIM_CHUNK) {
+      chunks.push(cur)
+      cur = ''
+    }
+    cur = cur ? `${cur}\n${line}` : line
+  }
+  if (cur) chunks.push(cur)
+  return chunks.length >= 4 && chunks.length <= TRIM_CHUNKS ? chunks : []
+}
+
+/** One question per chunk, all in one Jev call; the first and last chunks are always kept and not asked about. */
+export function trimRequest(request: string, chunks: string[]) {
+  const middle = chunks.slice(1, -1)
+  const questions: Questions = Object.fromEntries(middle.map((_, i) => [`c${i + 1}`, noul(
+    `Does \`chunks.c${i + 1}\` hold something \`request\` needs: an error, a failing test, a result, or the data asked for?`,
+    'An error or warning, a failure, a value or line the request is about',
+    'Progress lines, passing items, boilerplate or data unrelated to the request',
+  )]))
+  return { state: { request: clip(request, 1500), chunks: Object.fromEntries(middle.map((t, i) => [`c${i + 1}`, t])) }, questions }
+}
+
+/** The output with the chunks Jev rated unrelated replaced by one line each run; null when too little would go. */
+export function trimmed(chunks: string[], a: Answers, c: Config): string | null {
+  const keep = chunks.map((_, i) => i === 0 || i === chunks.length - 1 || nv(a, `c${i}`) >= c.trimKeep)
+  const total = chunks.reduce((n, t) => n + t.length, 0)
+  const kept = chunks.reduce((n, t, i) => n + (keep[i] ? t.length : 0), 0)
+  if (kept > total * 0.7) return null
+  const out: string[] = []
+  for (let i = 0; i < chunks.length; i++) {
+    if (keep[i]) out.push(chunks[i]!)
+    else if (keep[i - 1] !== false) {
+      let lines = 0
+      for (let j = i; j < chunks.length && !keep[j]; j++) lines += chunks[j]!.split('\n').length
+      out.push(`[ohmyjev: ${lines} lines left out as unrelated to the request. Rerun the command with grep or sed -n to see them.]`)
+    }
+  }
+  return out.join('\n')
+}
+
+// --- skill picker: the skill listing out of the prompt, Jev naming the one skill a request needs ---
+
+export type Skill = { name: string; description: string }
+
+/** One request: which skill fits, and three questions about whether the request needs one at all (TypeSafe's cookbook). */
+export const skillQuestions = (skills: readonly Skill[]): Questions => ({
+  which: choice('Which skill in the list best fits `request`?', Object.fromEntries(skills.slice(0, 100).map(s => [s.name, clip(s.description, 300) || s.name]))),
+  acts_on_user_system: noul('Is the assistant asked to act on the user\'s files, accounts, devices or services, rather than only to explain or advise?'),
+  would_follow_documented_procedure: noul('Would a careful expert follow a specific documented procedure or set of commands, rather than answer from general understanding?'),
+  prose_suffices: noul('Could a knowledgeable generalist fully satisfy `request` in prose, with no tools and no access to the user\'s files?'),
+})
+
+/** The skill to name, when the request needs one (the gate's mean) and Jev's pick is clear enough; else null. */
+export function pickSkill(a: Answers, c: Config): { name: string; gate: number; confidence: number } | null {
+  const gate = (nv(a, 'acts_on_user_system') + nv(a, 'would_follow_documented_procedure') + (1 - nv(a, 'prose_suffices'))) / 3
+  const w = ch(a, 'which')
+  if (!w || gate < c.skillGate || w.confidence < c.skillMin) return null
+  return { name: w.choice, gate, confidence: w.confidence }
+}
+
+/** The second request: does the picked skill do the specific thing asked? It can say no, so an only option isn't forced. */
+export const fitsQuestion = (s: Skill): Questions => ({
+  fits: noul(
+    `Does the skill "${s.name}" (${clip(s.description, 600)}) do the specific thing \`request\` asks for?`,
+    'It is the documented procedure for exactly this task',
+    'It is about something else, only nearby, or the request needs no procedure',
+  ),
+})
+export const skillFits = (a: Answers, c: Config): boolean => nv(a, 'fits') >= c.skillGate
+
+export const skillNote = (name: string): string =>
+  `<skill_relevance>\nRelevant to the current request: the ${name} skill. Load it with the Skill tool (${name}) before you start, and ` +
+  'follow it. Ignore this if it does not fit what the user actually asked for.\n</skill_relevance>'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohmyjev",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Guardrails for coding agents, decided by TypeSafe's Jev: blocks destructive commands, catches prompt injection, pushes back on an unverified done and routes effort per turn. For Claude Code, pi and omp.",
   "type": "module",
   "license": "MIT",
@@ -136,6 +136,61 @@
         "description": "Deny when Jev rates a call as sending local data out at least this probably (0-1)",
         "default": 0.7
       },
+      "autoApprove": {
+        "type": "boolean",
+        "description": "Where the host would ask you, run a command or in-repo edit Jev is sure is safe instead",
+        "default": true
+      },
+      "approveConfidence": {
+        "type": "number",
+        "description": "How sure Jev must be that a command only reads or is reversible (0-1)",
+        "default": 0.9
+      },
+      "approveRiskMax": {
+        "type": "number",
+        "description": "Destructive, data-leaving or credential probability under which a call is approved (0-1)",
+        "default": 0.2
+      },
+      "stuckCheck": {
+        "type": "boolean",
+        "description": "After repeated failed calls, ask Jev whether the agent is stuck on one approach and tell it to change course",
+        "default": true
+      },
+      "stuck": {
+        "type": "number",
+        "description": "How sure Jev must be that the failures repeat one approach before the note (0-1)",
+        "default": 0.7
+      },
+      "trimOutput": {
+        "type": "boolean",
+        "description": "Cut a long shell output to the parts your request needs, Jev rating each part",
+        "default": true
+      },
+      "trimOver": {
+        "type": "number",
+        "description": "Characters of shell output before trimming is considered",
+        "default": 12000
+      },
+      "trimKeep": {
+        "type": "number",
+        "description": "How likely Jev must rate a part as needed for it to stay (0-1)",
+        "default": 0.3
+      },
+      "skillPick": {
+        "type": "boolean",
+        "description": "Claude Code only: leave the skill listing out of every prompt; Jev names the one skill a request needs",
+        "default": true
+      },
+      "skillGate": {
+        "type": "number",
+        "description": "Claude Code only: how strongly Jev must rate a request as needing a skill (0-1)",
+        "default": 0.3
+      },
+      "skillMin": {
+        "type": "number",
+        "description": "Claude Code only: how sure Jev must be of which skill fits (0-1)",
+        "default": 0.4
+      },
       "requested": {
         "type": "number",
         "description": "A gate's Jev deny passes when Jev rates your latest message as asking for exactly that call at least this probable (0-1). Policy and path denies always stand",