pi-jev-auto-mode 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,11 +1,19 @@
 # Changelog
 
+## 0.1.1
+
+- Correct the product name. It is **Jev** — TypeSafe's System One model, spelled with a
+  capital J and lowercase `ev`, as in their announcement, FAQ, and the model id
+  `typesafe-ai/jev` — not "JEV". Fixed in the README, docs, source comments, and the package
+  description. The `0.1.0` metadata cannot be edited, so this release exists to carry the
+  corrected name. No behavioral change.
+
 ## 0.1.0
 
 Initial release.
 
 - Two-layer gate: a deterministic policy envelope (hard-deny, allow/deny patterns,
-  dangerous-command detection, protected paths) and a JEV semantic layer that only sees
+  dangerous-command detection, protected paths) and a Jev semantic layer that only sees
   what the first layer escalated.
 - Conditions carry a `mode` (`required` / `hazard`) and a `severity` (`hazard` / `soft`),
   calibrated against measured probabilities from the real API (`docs/calibration.md`).

package/README.md

@@ -1,12 +1,12 @@
 # pi-jev-auto-mode
 
 Auto mode for the [Pi coding agent](https://github.com/earendil-works/pi-mono) backed by
-**JEV** (TypeSafe System One, a decision-only model). Pi has no built-in permission system,
+**Jev** (TypeSafe System One, a decision-only model). Pi has no built-in permission system,
 so a gate either exists as an extension or it does not exist at all. This one judges
 `bash`, `write`, and `edit` tool calls semantically and **fails closed** whenever a decision
 cannot be made.
 
-> **Status: milestones 1–3 are complete.** The deterministic envelope, the JEV engine,
+> **Status: milestones 1–3 are complete.** The deterministic envelope, the Jev engine,
 > real-API calibration, settings, policy notes, per-rule threshold tuning, and decision
 > records are implemented and tested (157 tests, no network). See [`docs/design.md`](./docs/design.md) for
 > the roadmap and [`docs/calibration.md`](./docs/calibration.md) for the measured
@@ -18,22 +18,22 @@ The gate has two layers, in this order:
 
 1. **Deterministic policy** — hard-deny commands, your allow/deny patterns, dangerous-command
    detection, protected paths. Hard-deny is never handed to the semantic layer.
-2. **Semantic judgment (JEV)** — only the calls the first layer escalated.
+2. **Semantic judgment (Jev)** — only the calls the first layer escalated.
 
 ```
-hard-deny               → block (never reaches JEV)
+hard-deny               → block (never reaches Jev)
 your deny pattern       → block
 your allow pattern      → allow
 safe read-only command  → run, no record
 in-project write/edit   → run, no record
-everything else         → JEV: allow · block · confirm · block-if-undecidable
+everything else         → Jev: allow · block · confirm · block-if-undecidable
 ```
 
 `rm -rf build` inside the repository is recognized as a scoped local deletion. A write to
 `.env`, `.git/`, `~/.ssh`, `.pi/`, `.github/workflows/`, or `AGENTS.md` is escalated even when
 the path is inside the working directory.
 
-### How JEV decides
+### How Jev decides
 
 Conditions are phrased so the safe state is "yes", and each one is classified by
 `mode` and `severity`:
@@ -91,7 +91,7 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 pi --jev-auto-mode        start with auto mode enabled
 ```
 
-The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. JEV is early access, so an
+The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. Jev is early access, so an
 account may be waitlisted; **the gate still works without one**, running in ask-only mode
 (confirm in a UI, block without one) rather than silently allowing everything.
 
@@ -231,10 +231,10 @@ Layout:
 The deterministic pattern catalogue is adapted from
 [`@nilskluewer/pi-auto-permission-gate`](https://github.com/nilskluewer/pi-auto-permission-gate)
 (MIT), and the three-layer structure (fast paths → hard rules → classifier) follows the same
-extension and Qwen Code's Auto Mode. The JEV design constraints (fail closed, two-sided
+extension and Qwen Code's Auto Mode. The Jev design constraints (fail closed, two-sided
 thresholds that keep the middle band meaningful, one request per judgment) come from measuring
 the API directly — [`docs/calibration.md`](./docs/calibration.md) records the measurements and
-the reasoning. Nothing here depends on a wrapper library: the JEV layer is written against the
+the reasoning. Nothing here depends on a wrapper library: the Jev layer is written against the
 official SDK.
 
 ## License

package/SECURITY.md

@@ -6,7 +6,7 @@ This extension stands between a coding agent and your shell, so its own failure
 
 Open a private security advisory on the repository, or an issue if the report does not need to
 stay private. Please include the tool call, the recorded decision (`/jev-auto-mode` records
-are expandable in the transcript), and the JEV probabilities if you have them.
+are expandable in the transcript), and the Jev probabilities if you have them.
 
 ## What is in scope
 
@@ -23,7 +23,7 @@ The gate is two layers and the order is the enforcement:
 1. A deterministic envelope (hard-deny, user rules, dangerous-command patterns, protected
    paths). Hard-deny returns before the semantic layer is constructed, so a probabilistic
    verdict can never resurrect it.
-2. JEV, which only sees calls the first layer escalated.
+2. Jev, which only sees calls the first layer escalated.
 
 Anything that cannot be decided — no key, timeout, malformed response, a response missing an
 answer, cancellation, an oversized request — blocks. See

package/docs/calibration.md

@@ -18,7 +18,7 @@ Thirteen fixtures, one request each (6–7 `noul` questions per request), first
 2026-09-17 against `jev-latest`. Every condition's probability is printed, not just
 the failing ones, because a threshold cannot be chosen without the passing values.
 
-> **Caveat.** This is one sample per fixture. JEV is probabilistic: reruns moved
+> **Caveat.** This is one sample per fixture. Jev is probabilistic: reruns moved
 > some conditions by ±0.05 (for example `local_scope` on the pytest fixture was
 > 0.78 and 0.81 across runs, `path_not_protected` on the `.env` fixture 0.28 and
 > 0.25). Treat the numbers as evidence about *bands*, not as exact values, and

package/docs/design.md

@@ -16,11 +16,11 @@ Two prior arts shaped the structure:
 | [`@nilskluewer/pi-auto-permission-gate`](https://github.com/nilskluewer/pi-auto-permission-gate) (Pi extension) | hard-deny → user rules → classifier → confirmation → no-UI block; classifier failure is fail-closed; decisions recorded with `pi.appendEntry` (out of LLM context); user policy as a Markdown note; allow patterns disabled for shell control syntax |
 | Qwen Code Auto Mode | three layers: deterministic fast paths and allow rules first, then a classifier; protected "persistence surfaces" (`package.json`, `.github/workflows/`, agent config) always go through the classifier even when the target is inside the workspace |
 
-What is different here: the classifier is **JEV**, a decision-only model (unstructured state in,
+What is different here: the classifier is **Jev**, a decision-only model (unstructured state in,
 typed decisions out). The call is cheap, has no tokens to inject through, and returns calibrated
 probabilities rather than prose that has to be parsed.
 
-JEV facts this design leans on:
+Jev facts this design leans on:
 
 - One request carries many `noul` questions; they are evaluated **in parallel and
   independently**, so adding questions barely changes latency.
@@ -35,13 +35,13 @@ JEV facts this design leans on:
 ```
 tool_call(bash | write | edit)
   ├─ 0. auto mode off / tool not gated        → pass through
-  ├─ 1. hard-deny (deterministic)             → block, no JEV     ┐
-  ├─ 2. user disallow pattern                 → block, no JEV     ├ JEV never sees these
+  ├─ 1. hard-deny (deterministic)             → block, no Jev     ┐
+  ├─ 2. user disallow pattern                 → block, no Jev     ├ Jev never sees these
   ├─ 3. user allow pattern                    → allow (recorded)  ┘
   ├─ 4. read-only command, or user-declared safe command
   │                                           → pass through (silent)
   ├─ 5. in-project write/edit, unprotected    → pass through (silent)
-  └─ 6. JEV: one request, all conditions
+  └─ 6. Jev: one request, all conditions
          ├ every `required` condition satisfied, no hazard rejected → allow
          ├ any `hazard` condition rejected    → block
          ├ any `soft` condition rejected      → block, unless the user's own request covers it
@@ -105,7 +105,7 @@ the published package:
 
 - `scripts/calibrate.ts` sends the fixture set and prints every condition's probability.
 - `scripts/e2e.ts` runs the same fixtures through the real gate path (deterministic layer,
-  real JEV, block/ask routing, records) and compares the decision against the expectation.
+  real Jev, block/ask routing, records) and compares the decision against the expectation.
 
 ## Remaining work
 

package/docs/security.md

@@ -76,7 +76,7 @@ when it said `deny` or when no decision was available.
   paths: a write there changes what the agent believes it was told.
 - One dedicated condition (`prompt_injection_absent`) asks whether the call is trying to make
   other state act as instructions.
-- The gate never returns a JEV rationale verbatim as a system-level instruction; a block
+- The gate never returns a Jev rationale verbatim as a system-level instruction; a block
   reason is a tool-call error string, which is the weakest channel it can use.
 
 ## What is sent to TypeSafe

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.1.0",
-  "description": "JEV (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
+  "version": "0.1.1",
+  "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",
     "pi-extension",

package/src/call.ts

@@ -1,5 +1,5 @@
 /**
- * Turn a Pi tool call into the shape JEV will judge.
+ * Turn a Pi tool call into the shape Jev will judge.
  *
  * What leaves this module is what a third party (TypeSafe) gets to see, so the
  * boundary is explicit: the command text and the target path are sent, file
@@ -143,7 +143,7 @@ export const NO_POLICY_PLACEHOLDER = "(no user policy configured)";
 export const NO_INTENT_PLACEHOLDER = "(no recent user message available)";
 
 /**
- * Assemble the JEV request state.
+ * Assemble the Jev request state.
  *
  * The user policy is `context` (session-scoped) so conditions can name it, and
  * the call plus the user intent are `value` (per-call).

package/src/decide.ts

@@ -3,7 +3,7 @@
  *
  * The gate itself (ordering, blocking, recording) is deterministic. Everything
  * probabilistic sits behind `DecisionEngine`, so the extension can be tested
- * without a network and so the JEV implementation can be swapped or disabled
+ * without a network and so the Jev implementation can be swapped or disabled
  * without touching the safety-critical path.
  */
 

package/src/extension.ts

@@ -1,11 +1,11 @@
 /**
- * JEV auto mode for the Pi coding agent.
+ * Jev auto mode for the Pi coding agent.
  *
  * The gate has two layers, and the order matters:
  *
  *   1. A deterministic policy layer (hard-deny, user rules, dangerous-pattern
  *      detection, protected paths). Hard-deny is not negotiable.
- *   2. A semantic layer (JEV) that only ever sees calls the deterministic layer
+ *   2. A semantic layer (Jev) that only ever sees calls the deterministic layer
  *      decided to escalate, and whose "allow" can never resurrect a hard-denied
  *      call.
  *
@@ -171,7 +171,7 @@ function permit(deps: DecisionDeps, input: RecordInput): undefined {
 
 /** Wraps an engine rationale so the model gets an actionable reason, not a verdict. */
 function blockReason(rationale: string): string {
-  return `JEV auto mode blocked this tool call. ${rationale} Do not repeat the same call unchanged; change the approach or ask the user.`;
+  return `Jev auto mode blocked this tool call. ${rationale} Do not repeat the same call unchanged; change the approach or ask the user.`;
 }
 
 /**
@@ -318,7 +318,7 @@ export async function evaluateToolCall(
       }
 
       const dialog = [
-        "JEV auto mode wants confirmation before this runs.",
+        "Jev auto mode wants confirmation before this runs.",
         "",
         `Tool: ${call.tool}`,
         ...(call.command ? [call.command] : []),
@@ -338,7 +338,7 @@ export async function evaluateToolCall(
           rationale: "The user declined the confirmation.",
           evidence,
         });
-        return { block: true, reason: "Blocked by the user at the JEV auto mode confirmation." };
+        return { block: true, reason: "Blocked by the user at the Jev auto mode confirmation." };
       }
 
       return permit(deps, {
@@ -450,7 +450,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
   };
 
   pi.registerFlag(AUTO_MODE_FLAG, {
-    description: "Start with JEV auto mode enabled",
+    description: "Start with Jev auto mode enabled",
     type: "boolean",
     default: false,
   });
@@ -458,7 +458,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
   registerDecisionEntryRenderer(pi);
 
   pi.registerCommand(AUTO_MODE_COMMAND, {
-    description: "Show or change the JEV auto mode settings",
+    description: "Show or change the Jev auto mode settings",
     getArgumentCompletions: (argumentPrefix) => {
       const value = String(argumentPrefix ?? "");
       const tokens = value.split(/\s+/).filter(Boolean);
@@ -513,7 +513,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
           engineId: deps.engine.id,
           scope: state.scope,
         });
-        ctx.ui.notify(`JEV auto mode ${value === "on" ? "enabled" : "disabled"}.`, "info");
+        ctx.ui.notify(`Jev auto mode ${value === "on" ? "enabled" : "disabled"}.`, "info");
         return;
       }
 
@@ -523,7 +523,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
       }
 
       if (value === "policy edit") {
-        const edited = await ctx.ui.editor("JEV auto mode policy", state.policyNotes || POLICY_HEADER);
+        const edited = await ctx.ui.editor("Jev auto mode policy", state.policyNotes || POLICY_HEADER);
         if (edited === undefined) return;
         await store.savePolicyNotes(edited);
         state.policyNotes = await store.loadPolicyNotes();
@@ -533,7 +533,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
 
       if (value === "policy clear") {
         const confirmed = await ctx.ui.confirm(
-          "Clear JEV auto mode policy notes?",
+          "Clear Jev auto mode policy notes?",
           "The semantic layer will fall back to its built-in criteria.",
         );
         if (!confirmed) return;

package/src/jev/criteria.ts

@@ -1,7 +1,7 @@
 /**
  * Shared noul criteria.
  *
- * The default criteria matter more than they look. JEV is calibrated, and
+ * The default criteria matter more than they look. Jev is calibrated, and
  * `noul` has no `confidence` field: the only signal is the probability. If the
  * criteria leave the middle open, an ambiguous condition lands somewhere in the
  * middle and the two-sided thresholds in `decide.ts` can route it to a human.

package/src/jev/decide.ts

@@ -7,7 +7,7 @@
  *   p <= 1 - t      → rejected ("the opposite is as certain as a pass would be")
  *   in between      → the middle band
  *
- * The middle band is not a bug to be squeezed out. Measured JEV answers sit at
+ * The middle band is not a bug to be squeezed out. Measured Jev answers sit at
  * 0.98/0.02 for clear cases but also at 0.85–0.95 for conditions that are clear
  * to a human and merely not certain to the model, so a single high bar would
  * report almost everything as uncertain. What the middle band *means* depends on

package/src/jev/engine.ts

@@ -1,8 +1,8 @@
 /**
- * The JEV decision engine.
+ * The Jev decision engine.
  *
  * One tool call in, one request out. All conditions for the call travel in the
- * same request because JEV answers them in parallel and independently, so the
+ * same request because Jev answers them in parallel and independently, so the
  * marginal cost of an extra condition is a few tokens rather than a round trip.
  *
  * Everything that can go wrong resolves to `unavailable`, and the caller turns
@@ -43,12 +43,12 @@ export interface JevEngineOptions {
 export const DEFAULT_MAX_STATE_CHARACTERS = 120_000;
 
 const UNAVAILABLE_TEXT: Record<string, string> = {
-  timeout: "the JEV request timed out",
-  network: "the JEV request could not reach the API",
-  http: "the JEV API returned an error status",
-  malformed_response: "the JEV response did not match the questions that were asked",
+  timeout: "the Jev request timed out",
+  network: "the Jev request could not reach the API",
+  http: "the Jev API returned an error status",
+  malformed_response: "the Jev response did not match the questions that were asked",
   state_too_large: "the call description exceeded the request budget",
-  unknown: "the JEV request failed for an unknown reason",
+  unknown: "the Jev request failed for an unknown reason",
 };
 
 export function createJevEngine(options: JevEngineOptions): DecisionEngine {
@@ -99,7 +99,7 @@ export function createJevEngine(options: JevEngineOptions): DecisionEngine {
         return {
           verdict: "unavailable",
           reason: result.reason,
-          rationale: UNAVAILABLE_TEXT[result.reason] ?? UNAVAILABLE_TEXT.unknown ?? "JEV could not decide.",
+          rationale: UNAVAILABLE_TEXT[result.reason] ?? UNAVAILABLE_TEXT.unknown ?? "Jev could not decide.",
           latencyMs,
         };
       }
@@ -109,7 +109,7 @@ export function createJevEngine(options: JevEngineOptions): DecisionEngine {
         return {
           verdict: "unavailable",
           reason: parsed.reason,
-          rationale: UNAVAILABLE_TEXT[parsed.reason] ?? "The JEV response could not be used.",
+          rationale: UNAVAILABLE_TEXT[parsed.reason] ?? "The Jev response could not be used.",
           latencyMs,
         };
       }

package/src/jev/index.ts

@@ -1,5 +1,5 @@
 /**
- * JEV layer: transport, question set, response validation, and the engine.
+ * Jev layer: transport, question set, response validation, and the engine.
  */
 
 export { createJevEngine, DEFAULT_MAX_STATE_CHARACTERS, type JevEngineOptions, type ObservationMeta } from "./engine.ts";

package/src/jev/questions.ts

@@ -1,7 +1,7 @@
 /**
  * The question set.
  *
- * Two things learned from real JEV answers (see `docs/calibration.md`) shaped
+ * Two things learned from real Jev answers (see `docs/calibration.md`) shaped
  * this design:
  *
  * 1. **"Absence of a hazard" questions cluster between 0.75 and 0.98.** Asking
@@ -15,7 +15,7 @@
  *    for". That is the `required` condition. Everything else answers "is a
  *    specific bad thing happening", and a clear "yes, it is" should block.
  *
- * JEV evaluates questions in parallel and independently and does not send the
+ * Jev evaluates questions in parallel and independently and does not send the
  * question keys to the model, so each instruction must stand alone.
  */
 

package/src/jev/state.ts

@@ -1,11 +1,11 @@
 /**
- * Shapes shared with the JEV layer.
+ * Shapes shared with the Jev layer.
  *
  * These are types only. The transport, question set, and decision mapping live in
  * this directory too, but they arrive in a later milestone.
  */
 
-/** A JSON value accepted by the JEV `state` field. `Date` / `Map` are not included. */
+/** A JSON value accepted by the Jev `state` field. `Date` / `Map` are not included. */
 export type JevJson = string | number | boolean | null | JevJson[] | { [key: string]: JevJson };
 
 /**

package/src/jev/types.ts

@@ -1,5 +1,5 @@
 /**
- * The JEV transport contract.
+ * The Jev transport contract.
  *
  * The interface is deliberately narrow and its result type is normalized: the
  * official SDK's exception hierarchy stops at `transport.ts`, so the engine and

package/src/policy.ts

@@ -1,7 +1,7 @@
 /**
  * Deterministic policy layer.
  *
- * Everything in this module runs before JEV. Hard-deny rules are deliberate,
+ * Everything in this module runs before Jev. Hard-deny rules are deliberate,
  * non-overridable, and must never be reachable by a probabilistic decision: they
  * are the floor that keeps a mis-calibrated semantic verdict from becoming an
  * approved `rm -rf /`.
@@ -13,9 +13,9 @@
 import { isAbsolute, relative, resolve, sep } from "node:path";
 
 export interface CommandRuleConfig {
-  /** Shell-style `*` / `?` patterns that auto-approve without asking JEV. */
+  /** Shell-style `*` / `?` patterns that auto-approve without asking Jev. */
   readonly allowedCommands: readonly string[];
-  /** Shell-style patterns that block immediately, before JEV. */
+  /** Shell-style patterns that block immediately, before Jev. */
   readonly disallowedCommands: readonly string[];
 }
 
@@ -196,7 +196,7 @@ const DANGEROUS_PATTERNS: readonly CommandPattern[] = [
 ];
 
 /**
- * Catastrophic targets. These are never handed to JEV: a look-alike approval
+ * Catastrophic targets. These are never handed to Jev: a look-alike approval
  * would be unsafe even when the surrounding conversation seems to ask for it.
  *
  * The list is deliberately small. Everything else belongs to the semantic layer,
@@ -437,7 +437,7 @@ export interface WriteTarget {
  * Classify a write/edit target lexically.
  *
  * A symlink inside the working directory can still point outside it; resolving
- * that needs a filesystem call and belongs to the JEV layer's state building.
+ * that needs a filesystem call and belongs to the Jev layer's state building.
  */
 export function classifyWriteTarget(
   inputPath: string,

package/src/settings.ts

@@ -16,7 +16,7 @@ import { dirname, join } from "node:path";
 
 export interface JevAutoModeSettings {
   readonly enabled: boolean;
-  /** Per-attempt JEV timeout. Kept short: this is a gate, not a batch job. */
+  /** Per-attempt Jev timeout. Kept short: this is a gate, not a batch job. */
   readonly timeoutMs: number;
   /** Retries after the first attempt. */
   readonly maxRetries: number;
@@ -226,7 +226,7 @@ export class JevAutoModeStore {
     await writeFileAtomic(path, `${JSON.stringify(settings, null, 2)}\n`);
   }
 
-  /** User-authored policy notes. Advisory input to JEV, never a hard rule. */
+  /** User-authored policy notes. Advisory input to Jev, never a hard rule. */
   async loadPolicyNotes(): Promise<string> {
     try {
       return (await readFile(this.policyNotesPath(), "utf8")).slice(0, MAX_POLICY_NOTES_LENGTH);

package/src/ui.ts

@@ -60,7 +60,7 @@ export const USAGE_TEXT = [
 ].join("\n");
 
 export const POLICY_HEADER = [
-  "# JEV auto mode policy",
+  "# Jev auto mode policy",
   "",
   "Free-form notes describing what this machine and these repositories allow.",
   "They are reference material for the semantic judgment: they can justify an",