pi-jev-auto-mode 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,11 +1,37 @@
 # Changelog
 
+## 0.2.0
+
+- **The middle band no longer asks the user by default.** An auto mode that stops to ask has
+  handed the decision back to a human, and the agent can always ask in conversation if it needs
+  guidance. A judgment that is neither satisfied nor rejected now blocks, so the gate never
+  takes over the screen.
+- `uncertain` setting and `/jev-auto-mode uncertain deny|ask|allow` control it. `deny` is the
+  default; `ask` restores the confirmation dialog; `allow` trusts the band.
+- `/jev-auto-mode threshold edit` picks a rule and prompts for a value, showing each rule's
+  current threshold next to the last probability the model returned for it.
+
+## 0.1.2
+
+- Fix the screen thrashing that happened whenever a judgment was delegated to the user: the
+  confirmation dialog was handed the whole command, and Pi's dialogs do not clip their content,
+  so a long command produced a dialog taller than the terminal. The dialog now shows a bounded
+  preview and says what was hidden.
+
+## 0.1.1
+
+- Correct the product name. It is **Jev** — TypeSafe's System One model, spelled with a
+  capital J and lowercase `ev`, as in their announcement, FAQ, and the model id
+  `typesafe-ai/jev` — not "JEV". Fixed in the README, docs, source comments, and the package
+  description. The `0.1.0` metadata cannot be edited, so this release exists to carry the
+  corrected name. No behavioral change.
+
 ## 0.1.0
 
 Initial release.
 
 - Two-layer gate: a deterministic policy envelope (hard-deny, allow/deny patterns,
-  dangerous-command detection, protected paths) and a JEV semantic layer that only sees
+  dangerous-command detection, protected paths) and a Jev semantic layer that only sees
   what the first layer escalated.
 - Conditions carry a `mode` (`required` / `hazard`) and a `severity` (`hazard` / `soft`),
   calibrated against measured probabilities from the real API (`docs/calibration.md`).

package/README.md

@@ -1,14 +1,14 @@
 # pi-jev-auto-mode
 
 Auto mode for the [Pi coding agent](https://github.com/earendil-works/pi-mono) backed by
-**JEV** (TypeSafe System One, a decision-only model). Pi has no built-in permission system,
+**Jev** (TypeSafe System One, a decision-only model). Pi has no built-in permission system,
 so a gate either exists as an extension or it does not exist at all. This one judges
 `bash`, `write`, and `edit` tool calls semantically and **fails closed** whenever a decision
 cannot be made.
 
-> **Status: milestones 1–3 are complete.** The deterministic envelope, the JEV engine,
+> **Status: milestones 1–3 are complete.** The deterministic envelope, the Jev engine,
 > real-API calibration, settings, policy notes, per-rule threshold tuning, and decision
-> records are implemented and tested (157 tests, no network). See [`docs/design.md`](./docs/design.md) for
+> records are implemented and tested (171 tests, no network). See [`docs/design.md`](./docs/design.md) for
 > the roadmap and [`docs/calibration.md`](./docs/calibration.md) for the measured
 > probabilities behind every threshold.
 
@@ -18,22 +18,22 @@ The gate has two layers, in this order:
 
 1. **Deterministic policy** — hard-deny commands, your allow/deny patterns, dangerous-command
    detection, protected paths. Hard-deny is never handed to the semantic layer.
-2. **Semantic judgment (JEV)** — only the calls the first layer escalated.
+2. **Semantic judgment (Jev)** — only the calls the first layer escalated.
 
 ```
-hard-deny               → block (never reaches JEV)
+hard-deny               → block (never reaches Jev)
 your deny pattern       → block
 your allow pattern      → allow
 safe read-only command  → run, no record
 in-project write/edit   → run, no record
-everything else         → JEV: allow · block · confirm · block-if-undecidable
+everything else         → Jev: allow · block · block-if-undecidable
 ```
 
 `rm -rf build` inside the repository is recognized as a scoped local deletion. A write to
 `.env`, `.git/`, `~/.ssh`, `.pi/`, `.github/workflows/`, or `AGENTS.md` is escalated even when
 the path is inside the working directory.
 
-### How JEV decides
+### How Jev decides
 
 Conditions are phrased so the safe state is "yes", and each one is classified by
 `mode` and `severity`:
@@ -48,8 +48,13 @@ Conditions are phrased so the safe state is "yes", and each one is classified by
 So `intent_coverage` ("is this what the user asked for?") is the permission question, and
 questions like "is a secret being sent to a network endpoint" are hazard detectors that only
 block when they are sure. Posting a private key is never cleared by intent; force-pushing a
-feature branch the user asked for is. Everything that cannot be decided — no engine, timeout,
-malformed response, cancellation — blocks.
+feature branch the user asked for is.
+
+**Nothing is delegated to the user by default.** The middle band — where Jev is neither
+satisfied nor rejecting — resolves to a block, so Jev's probability is the whole answer and the
+gate never takes over the screen. `/jev-auto-mode uncertain ask` restores the confirmation
+dialog if you want it; `allow` trusts the band. Everything else that cannot be decided — no
+engine, timeout, malformed response, cancellation — also blocks.
 
 ## Install
 
@@ -84,14 +89,17 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 /jev-auto-mode policy clear
 /jev-auto-mode threshold                show thresholds and the last observed probability per rule
 /jev-auto-mode threshold <rule> <0.5-1> set one threshold
+/jev-auto-mode threshold edit            pick a rule and type a value
 /jev-auto-mode threshold reset [rule]   restore the calibrated default
+/jev-auto-mode uncertain                show what the middle band resolves to
+/jev-auto-mode uncertain deny|ask|allow
 ```
 
 ```
 pi --jev-auto-mode        start with auto mode enabled
 ```
 
-The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. JEV is early access, so an
+The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. Jev is early access, so an
 account may be waitlisted; **the gate still works without one**, running in ask-only mode
 (confirm in a UI, block without one) rather than silently allowing everything.
 
@@ -164,6 +172,7 @@ Policy notes: `$PI_CODING_AGENT_DIR/jev-auto-mode-policy.md`.
   "disallowedCommands": ["npm publish*"],
   "extraProtectedPaths": [],
   "maxStateCharacters": 120000,
+  "uncertain": "deny",
   "thresholds": {}
 }
 ```
@@ -231,10 +240,10 @@ Layout:
 The deterministic pattern catalogue is adapted from
 [`@nilskluewer/pi-auto-permission-gate`](https://github.com/nilskluewer/pi-auto-permission-gate)
 (MIT), and the three-layer structure (fast paths → hard rules → classifier) follows the same
-extension and Qwen Code's Auto Mode. The JEV design constraints (fail closed, two-sided
+extension and Qwen Code's Auto Mode. The Jev design constraints (fail closed, two-sided
 thresholds that keep the middle band meaningful, one request per judgment) come from measuring
 the API directly — [`docs/calibration.md`](./docs/calibration.md) records the measurements and
-the reasoning. Nothing here depends on a wrapper library: the JEV layer is written against the
+the reasoning. Nothing here depends on a wrapper library: the Jev layer is written against the
 official SDK.
 
 ## License

package/SECURITY.md

@@ -6,7 +6,7 @@ This extension stands between a coding agent and your shell, so its own failure
 
 Open a private security advisory on the repository, or an issue if the report does not need to
 stay private. Please include the tool call, the recorded decision (`/jev-auto-mode` records
-are expandable in the transcript), and the JEV probabilities if you have them.
+are expandable in the transcript), and the Jev probabilities if you have them.
 
 ## What is in scope
 
@@ -23,7 +23,7 @@ The gate is two layers and the order is the enforcement:
 1. A deterministic envelope (hard-deny, user rules, dangerous-command patterns, protected
    paths). Hard-deny returns before the semantic layer is constructed, so a probabilistic
    verdict can never resurrect it.
-2. JEV, which only sees calls the first layer escalated.
+2. Jev, which only sees calls the first layer escalated.
 
 Anything that cannot be decided — no key, timeout, malformed response, a response missing an
 answer, cancellation, an oversized request — blocks. See

package/docs/calibration.md

@@ -18,7 +18,7 @@ Thirteen fixtures, one request each (6–7 `noul` questions per request), first
 2026-09-17 against `jev-latest`. Every condition's probability is printed, not just
 the failing ones, because a threshold cannot be chosen without the passing values.
 
-> **Caveat.** This is one sample per fixture. JEV is probabilistic: reruns moved
+> **Caveat.** This is one sample per fixture. Jev is probabilistic: reruns moved
 > some conditions by ±0.05 (for example `local_scope` on the pytest fixture was
 > 0.78 and 0.81 across runs, `path_not_protected` on the `.env` fixture 0.28 and
 > 0.25). Treat the numbers as evidence about *bands*, not as exact values, and

package/docs/design.md

@@ -16,11 +16,11 @@ Two prior arts shaped the structure:
 | [`@nilskluewer/pi-auto-permission-gate`](https://github.com/nilskluewer/pi-auto-permission-gate) (Pi extension) | hard-deny → user rules → classifier → confirmation → no-UI block; classifier failure is fail-closed; decisions recorded with `pi.appendEntry` (out of LLM context); user policy as a Markdown note; allow patterns disabled for shell control syntax |
 | Qwen Code Auto Mode | three layers: deterministic fast paths and allow rules first, then a classifier; protected "persistence surfaces" (`package.json`, `.github/workflows/`, agent config) always go through the classifier even when the target is inside the workspace |
 
-What is different here: the classifier is **JEV**, a decision-only model (unstructured state in,
+What is different here: the classifier is **Jev**, a decision-only model (unstructured state in,
 typed decisions out). The call is cheap, has no tokens to inject through, and returns calibrated
 probabilities rather than prose that has to be parsed.
 
-JEV facts this design leans on:
+Jev facts this design leans on:
 
 - One request carries many `noul` questions; they are evaluated **in parallel and
   independently**, so adding questions barely changes latency.
@@ -35,17 +35,18 @@ JEV facts this design leans on:
 ```
 tool_call(bash | write | edit)
   ├─ 0. auto mode off / tool not gated        → pass through
-  ├─ 1. hard-deny (deterministic)             → block, no JEV     ┐
-  ├─ 2. user disallow pattern                 → block, no JEV     ├ JEV never sees these
+  ├─ 1. hard-deny (deterministic)             → block, no Jev     ┐
+  ├─ 2. user disallow pattern                 → block, no Jev     ├ Jev never sees these
   ├─ 3. user allow pattern                    → allow (recorded)  ┘
   ├─ 4. read-only command, or user-declared safe command
   │                                           → pass through (silent)
   ├─ 5. in-project write/edit, unprotected    → pass through (silent)
-  └─ 6. JEV: one request, all conditions
+  └─ 6. Jev: one request, all conditions
          ├ every `required` condition satisfied, no hazard rejected → allow
          ├ any `hazard` condition rejected    → block
          ├ any `soft` condition rejected      → block, unless the user's own request covers it
-         ├ any `required` condition unclear   → confirm in a UI, block without one
+         ├ any `required` condition unclear   → resolved by the `uncertain` setting
+         │                                      (default: block; `ask` prompts, `allow` passes)
          └ unavailable                        → block (fail-closed)
   └─ 7. record the decision via appendEntry (never enters LLM context)
 ```
@@ -76,7 +77,13 @@ participates:
 
 Composition happens in code, not in the model: one rejection from a `hazard`-severity condition
 blocks, a `soft` rejection is cleared by a satisfied `intent_coverage`, an unclear `required`
-condition escalates, otherwise the call is approved. One question, one judgment; no compound
+condition is resolved by the `uncertain` setting, otherwise the call is approved.
+
+The default for that resolution is `deny`. Handing an unclear judgment to the user is what a
+non-auto mode does, and it makes the gate a source of interruptions; the agent can ask in
+conversation if it needs guidance. The `ask` path still exists, and when it is used the dialog
+shows a bounded preview — Pi's dialogs do not clip their content, so an unbounded command
+produces a dialog taller than the terminal. One question, one judgment; no compound
 questions, and the model never has to weigh concerns against each other.
 
 `intent_coverage` is the only permission question. It reads user-authored messages only — never
@@ -98,14 +105,14 @@ shipped to everyone.
 
 ## Tests
 
-157 tests, none of which need a network or an API key: the engine and transport are stubbed so
+171 tests, none of which need a network or an API key: the engine and transport are stubbed so
 every branch — allow, deny, cleared-by-intent, uncertain, each unavailable reason, boundary
 probabilities — is deterministic. The real API is exercised by two scripts that are not part of
 the published package:
 
 - `scripts/calibrate.ts` sends the fixture set and prints every condition's probability.
 - `scripts/e2e.ts` runs the same fixtures through the real gate path (deterministic layer,
-  real JEV, block/ask routing, records) and compares the decision against the expectation.
+  real Jev, block/ask routing, records) and compares the decision against the expectation.
 
 ## Remaining work
 

package/docs/security.md

@@ -60,7 +60,9 @@ Everything below resolves to **block**. Silence is never consent.
 | State + questions over the shared budget | block (`state_too_large`) before the request is sent |
 | Engine throws | block (`engine_error`) |
 | Request cancelled (Esc) | block |
-| No UI available for a confirmation | block (`no-ui`) |
+| A middle-band judgment, with the default `uncertain: deny` | block (`uncertain`) |
+| A middle-band judgment with `uncertain: allow` | allow — an explicit choice to trust the band |
+| No UI available for a confirmation when `uncertain: ask` | block (`no-ui`) |
 | A condition answered by fewer than all keys | block (`malformed_response`) — a missing answer is never an approval |
 
 A confirmation is not a bypass: it runs only when the semantic layer said `uncertain`, never
@@ -76,7 +78,7 @@ when it said `deny` or when no decision was available.
   paths: a write there changes what the agent believes it was told.
 - One dedicated condition (`prompt_injection_absent`) asks whether the call is trying to make
   other state act as instructions.
-- The gate never returns a JEV rationale verbatim as a system-level instruction; a block
+- The gate never returns a Jev rationale verbatim as a system-level instruction; a block
   reason is a tool-call error string, which is the weakest channel it can use.
 
 ## What is sent to TypeSafe

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.1.0",
-  "description": "JEV (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
+  "version": "0.2.0",
+  "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",
     "pi-extension",

package/src/call.ts

@@ -1,5 +1,5 @@
 /**
- * Turn a Pi tool call into the shape JEV will judge.
+ * Turn a Pi tool call into the shape Jev will judge.
  *
  * What leaves this module is what a third party (TypeSafe) gets to see, so the
  * boundary is explicit: the command text and the target path are sent, file
@@ -143,7 +143,7 @@ export const NO_POLICY_PLACEHOLDER = "(no user policy configured)";
 export const NO_INTENT_PLACEHOLDER = "(no recent user message available)";
 
 /**
- * Assemble the JEV request state.
+ * Assemble the Jev request state.
  *
  * The user policy is `context` (session-scoped) so conditions can name it, and
  * the call plus the user intent are `value` (per-call).

package/src/decide.ts

@@ -3,13 +3,13 @@
  *
  * The gate itself (ordering, blocking, recording) is deterministic. Everything
  * probabilistic sits behind `DecisionEngine`, so the extension can be tested
- * without a network and so the JEV implementation can be swapped or disabled
+ * without a network and so the Jev implementation can be swapped or disabled
  * without touching the safety-critical path.
  */
 
 import type { GatedCall, RepoFacts } from "./call.ts";
 
-export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "unavailable" | "no-ui" | "user";
+export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "uncertain" | "unavailable" | "no-ui" | "user";
 
 /**
  * A display-ready report of one condition's judgment.

package/src/extension.ts

@@ -1,11 +1,11 @@
 /**
- * JEV auto mode for the Pi coding agent.
+ * Jev auto mode for the Pi coding agent.
  *
  * The gate has two layers, and the order matters:
  *
  *   1. A deterministic policy layer (hard-deny, user rules, dangerous-pattern
  *      detection, protected paths). Hard-deny is not negotiable.
- *   2. A semantic layer (JEV) that only ever sees calls the deterministic layer
+ *   2. A semantic layer (Jev) that only ever sees calls the deterministic layer
  *      decided to escalate, and whose "allow" can never resurrect a hard-denied
  *      call.
  *
@@ -51,9 +51,18 @@ import {
   type DecisionRecord,
   type DecisionRecorder,
 } from "./records.ts";
-import { DEFAULT_SETTINGS, JevAutoModeStore, parseThreshold, type JevAutoModeSettings, type SettingsScope } from "./settings.ts";
 import {
+  DEFAULT_SETTINGS,
+  JevAutoModeStore,
+  isUncertainAction,
+  parseThreshold,
+  type JevAutoModeSettings,
+  type SettingsScope,
+} from "./settings.ts";
+import {
+  buildConfirmationDialog,
   describeSettings,
+  UNCERTAIN_EXPLANATION,
   formatRuleTable,
   POLICY_HEADER,
   statusText,
@@ -171,7 +180,7 @@ function permit(deps: DecisionDeps, input: RecordInput): undefined {
 
 /** Wraps an engine rationale so the model gets an actionable reason, not a verdict. */
 function blockReason(rationale: string): string {
-  return `JEV auto mode blocked this tool call. ${rationale} Do not repeat the same call unchanged; change the approach or ask the user.`;
+  return `Jev auto mode blocked this tool call. ${rationale} Do not repeat the same call unchanged; change the approach or ask the user.`;
 }
 
 /**
@@ -308,6 +317,32 @@ export async function evaluateToolCall(
     }
 
     case "uncertain": {
+      // The middle band is a policy decision, not a prompt by default. An auto mode
+      // that stops to ask the user has handed the decision back to the human, and
+      // the agent can always ask in conversation if it needs guidance.
+      if (state.settings.uncertain === "deny") {
+        const rationale = `No condition decided the call, and the uncertain band is resolved to a block. ${verdict.rationale}`;
+        return blocked(deps, {
+          call,
+          reasons,
+          status: "blocked",
+          source: "uncertain",
+          rationale,
+          evidence,
+        });
+      }
+
+      if (state.settings.uncertain === "allow") {
+        return permit(deps, {
+          call,
+          reasons,
+          status: "allowed",
+          source: "uncertain",
+          rationale: `No condition was violated and the uncertain band is configured to allow. ${verdict.rationale}`,
+          evidence,
+        });
+      }
+
       if (!ctx.hasUI) {
         const rationale = `${verdict.rationale} No UI is available to confirm, so the call was blocked.`;
         return blocked(
@@ -317,16 +352,13 @@ export async function evaluateToolCall(
         );
       }
 
-      const dialog = [
-        "JEV auto mode wants confirmation before this runs.",
-        "",
-        `Tool: ${call.tool}`,
-        ...(call.command ? [call.command] : []),
-        ...(call.path ? [call.path] : []),
-        "",
-        `Matched: ${reasons.join(", ")}`,
-        `Rationale: ${verdict.rationale}`,
-      ].join("\n");
+      const dialog = buildConfirmationDialog({
+        tool: call.tool,
+        ...(call.command === undefined ? {} : { command: call.command }),
+        ...(call.path === undefined ? {} : { path: call.path }),
+        reasons,
+        rationale: verdict.rationale,
+      });
 
       const choice = await ctx.ui.select(dialog, ["No", "Yes"]);
       if (choice !== "Yes") {
@@ -338,7 +370,7 @@ export async function evaluateToolCall(
           rationale: "The user declined the confirmation.",
           evidence,
         });
-        return { block: true, reason: "Blocked by the user at the JEV auto mode confirmation." };
+        return { block: true, reason: "Blocked by the user at the Jev auto mode confirmation." };
       }
 
       return permit(deps, {
@@ -353,6 +385,47 @@ export async function evaluateToolCall(
   }
 }
 
+/**
+ * Pick a rule, then type a value.
+ *
+ * The direct form (`threshold <rule> <value>`) is faster once the rule ids are
+ * known; this exists so tuning does not require remembering them.
+ */
+async function editThreshold(
+  ctx: { ui: GateUi },
+  state: GateState,
+  observed: ReadonlyMap<string, ObservedCondition>,
+  save: (ctx: GateContext) => Promise<void>,
+  rebuild: () => Promise<void>,
+): Promise<void> {
+  const choices = DEFAULT_RULES.map((rule) => {
+    const threshold = state.settings.thresholds[rule.id] ?? rule.threshold;
+    const last = observed.get(rule.id);
+    return `${rule.id}  (t=${threshold}${last ? `, last p=${last.probability.toFixed(2)}` : ""})`;
+  });
+
+  const picked = await ctx.ui.select("Which condition?", choices);
+  if (picked === undefined) return;
+  const ruleId = picked.split(" ")[0] ?? "";
+  const rule = ruleById(ruleId);
+  if (!rule) return;
+
+  const current = state.settings.thresholds[ruleId] ?? rule.threshold;
+  const entered = await ctx.ui.input(`${ruleId}: threshold (0.5-1.0, default ${rule.threshold})`, String(current));
+  if (entered === undefined) return;
+
+  const threshold = parseThreshold(Number(entered.trim()));
+  if (threshold === undefined) {
+    ctx.ui.notify(`A threshold must be greater than 0.5 and at most 1.0 (got \`${entered.trim()}\`).`, "error");
+    return;
+  }
+
+  state.settings = { ...state.settings, thresholds: { ...state.settings.thresholds, [ruleId]: threshold } };
+  await save(ctx as unknown as GateContext);
+  await rebuild();
+  ctx.ui.notify(`\`${ruleId}\` now requires p >= ${threshold}`, "info");
+}
+
 export interface RegisterOptions {
   /** Override the engine (tests, or a different judgment backend). */
   readonly engine?: DecisionEngine;
@@ -450,7 +523,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
   };
 
   pi.registerFlag(AUTO_MODE_FLAG, {
-    description: "Start with JEV auto mode enabled",
+    description: "Start with Jev auto mode enabled",
     type: "boolean",
     default: false,
   });
@@ -458,7 +531,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
   registerDecisionEntryRenderer(pi);
 
   pi.registerCommand(AUTO_MODE_COMMAND, {
-    description: "Show or change the JEV auto mode settings",
+    description: "Show or change the Jev auto mode settings",
     getArgumentCompletions: (argumentPrefix) => {
       const value = String(argumentPrefix ?? "");
       const tokens = value.split(/\s+/).filter(Boolean);
@@ -513,7 +586,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
           engineId: deps.engine.id,
           scope: state.scope,
         });
-        ctx.ui.notify(`JEV auto mode ${value === "on" ? "enabled" : "disabled"}.`, "info");
+        ctx.ui.notify(`Jev auto mode ${value === "on" ? "enabled" : "disabled"}.`, "info");
         return;
       }
 
@@ -523,7 +596,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
       }
 
       if (value === "policy edit") {
-        const edited = await ctx.ui.editor("JEV auto mode policy", state.policyNotes || POLICY_HEADER);
+        const edited = await ctx.ui.editor("Jev auto mode policy", state.policyNotes || POLICY_HEADER);
         if (edited === undefined) return;
         await store.savePolicyNotes(edited);
         state.policyNotes = await store.loadPolicyNotes();
@@ -533,7 +606,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
 
       if (value === "policy clear") {
         const confirmed = await ctx.ui.confirm(
-          "Clear JEV auto mode policy notes?",
+          "Clear Jev auto mode policy notes?",
           "The semantic layer will fall back to its built-in criteria.",
         );
         if (!confirmed) return;
@@ -616,6 +689,28 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         return;
       }
 
+      if (value === "threshold edit") {
+        await editThreshold(ctx, state, observed, save, rebuildEngine);
+        return;
+      }
+
+      if (value.startsWith("uncertain")) {
+        const argument = value.slice("uncertain".length).trim();
+        if (argument === "") {
+          ctx.ui.notify(`uncertain: ${state.settings.uncertain}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+          return;
+        }
+        if (!isUncertainAction(argument)) {
+          ctx.ui.notify(`Expected one of deny, ask, allow.\n\n${UNCERTAIN_EXPLANATION}`, "error");
+          return;
+        }
+
+        state.settings = { ...state.settings, uncertain: argument };
+        await save(gateContext);
+        ctx.ui.notify(`uncertain band now resolves to: ${argument}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+        return;
+      }
+
       const thresholdMatch = /^threshold\s+(\S+)(?:\s+(\S+))?$/.exec(value);
       if (thresholdMatch) {
         const ruleId = thresholdMatch[1] ?? "";

package/src/jev/criteria.ts

@@ -1,7 +1,7 @@
 /**
  * Shared noul criteria.
  *
- * The default criteria matter more than they look. JEV is calibrated, and
+ * The default criteria matter more than they look. Jev is calibrated, and
  * `noul` has no `confidence` field: the only signal is the probability. If the
  * criteria leave the middle open, an ambiguous condition lands somewhere in the
  * middle and the two-sided thresholds in `decide.ts` can route it to a human.

package/src/jev/decide.ts

@@ -7,7 +7,7 @@
  *   p <= 1 - t      → rejected ("the opposite is as certain as a pass would be")
  *   in between      → the middle band
  *
- * The middle band is not a bug to be squeezed out. Measured JEV answers sit at
+ * The middle band is not a bug to be squeezed out. Measured Jev answers sit at
  * 0.98/0.02 for clear cases but also at 0.85–0.95 for conditions that are clear
  * to a human and merely not certain to the model, so a single high bar would
  * report almost everything as uncertain. What the middle band *means* depends on

package/src/jev/engine.ts

@@ -1,8 +1,8 @@
 /**
- * The JEV decision engine.
+ * The Jev decision engine.
  *
  * One tool call in, one request out. All conditions for the call travel in the
- * same request because JEV answers them in parallel and independently, so the
+ * same request because Jev answers them in parallel and independently, so the
  * marginal cost of an extra condition is a few tokens rather than a round trip.
  *
  * Everything that can go wrong resolves to `unavailable`, and the caller turns
@@ -43,12 +43,12 @@ export interface JevEngineOptions {
 export const DEFAULT_MAX_STATE_CHARACTERS = 120_000;
 
 const UNAVAILABLE_TEXT: Record<string, string> = {
-  timeout: "the JEV request timed out",
-  network: "the JEV request could not reach the API",
-  http: "the JEV API returned an error status",
-  malformed_response: "the JEV response did not match the questions that were asked",
+  timeout: "the Jev request timed out",
+  network: "the Jev request could not reach the API",
+  http: "the Jev API returned an error status",
+  malformed_response: "the Jev response did not match the questions that were asked",
   state_too_large: "the call description exceeded the request budget",
-  unknown: "the JEV request failed for an unknown reason",
+  unknown: "the Jev request failed for an unknown reason",
 };
 
 export function createJevEngine(options: JevEngineOptions): DecisionEngine {
@@ -99,7 +99,7 @@ export function createJevEngine(options: JevEngineOptions): DecisionEngine {
         return {
           verdict: "unavailable",
           reason: result.reason,
-          rationale: UNAVAILABLE_TEXT[result.reason] ?? UNAVAILABLE_TEXT.unknown ?? "JEV could not decide.",
+          rationale: UNAVAILABLE_TEXT[result.reason] ?? UNAVAILABLE_TEXT.unknown ?? "Jev could not decide.",
           latencyMs,
         };
       }
@@ -109,7 +109,7 @@ export function createJevEngine(options: JevEngineOptions): DecisionEngine {
         return {
           verdict: "unavailable",
           reason: parsed.reason,
-          rationale: UNAVAILABLE_TEXT[parsed.reason] ?? "The JEV response could not be used.",
+          rationale: UNAVAILABLE_TEXT[parsed.reason] ?? "The Jev response could not be used.",
           latencyMs,
         };
       }

package/src/jev/index.ts

@@ -1,5 +1,5 @@
 /**
- * JEV layer: transport, question set, response validation, and the engine.
+ * Jev layer: transport, question set, response validation, and the engine.
  */
 
 export { createJevEngine, DEFAULT_MAX_STATE_CHARACTERS, type JevEngineOptions, type ObservationMeta } from "./engine.ts";

package/src/jev/questions.ts

@@ -1,7 +1,7 @@
 /**
  * The question set.
  *
- * Two things learned from real JEV answers (see `docs/calibration.md`) shaped
+ * Two things learned from real Jev answers (see `docs/calibration.md`) shaped
  * this design:
  *
  * 1. **"Absence of a hazard" questions cluster between 0.75 and 0.98.** Asking
@@ -15,7 +15,7 @@
  *    for". That is the `required` condition. Everything else answers "is a
  *    specific bad thing happening", and a clear "yes, it is" should block.
  *
- * JEV evaluates questions in parallel and independently and does not send the
+ * Jev evaluates questions in parallel and independently and does not send the
  * question keys to the model, so each instruction must stand alone.
  */
 

package/src/jev/state.ts

@@ -1,11 +1,11 @@
 /**
- * Shapes shared with the JEV layer.
+ * Shapes shared with the Jev layer.
  *
  * These are types only. The transport, question set, and decision mapping live in
  * this directory too, but they arrive in a later milestone.
  */
 
-/** A JSON value accepted by the JEV `state` field. `Date` / `Map` are not included. */
+/** A JSON value accepted by the Jev `state` field. `Date` / `Map` are not included. */
 export type JevJson = string | number | boolean | null | JevJson[] | { [key: string]: JevJson };
 
 /**

package/src/jev/types.ts

@@ -1,5 +1,5 @@
 /**
- * The JEV transport contract.
+ * The Jev transport contract.
  *
  * The interface is deliberately narrow and its result type is normalized: the
  * official SDK's exception hierarchy stops at `transport.ts`, so the engine and

package/src/policy.ts

@@ -1,7 +1,7 @@
 /**
  * Deterministic policy layer.
  *
- * Everything in this module runs before JEV. Hard-deny rules are deliberate,
+ * Everything in this module runs before Jev. Hard-deny rules are deliberate,
  * non-overridable, and must never be reachable by a probabilistic decision: they
  * are the floor that keeps a mis-calibrated semantic verdict from becoming an
  * approved `rm -rf /`.
@@ -13,9 +13,9 @@
 import { isAbsolute, relative, resolve, sep } from "node:path";
 
 export interface CommandRuleConfig {
-  /** Shell-style `*` / `?` patterns that auto-approve without asking JEV. */
+  /** Shell-style `*` / `?` patterns that auto-approve without asking Jev. */
   readonly allowedCommands: readonly string[];
-  /** Shell-style patterns that block immediately, before JEV. */
+  /** Shell-style patterns that block immediately, before Jev. */
   readonly disallowedCommands: readonly string[];
 }
 
@@ -196,7 +196,7 @@ const DANGEROUS_PATTERNS: readonly CommandPattern[] = [
 ];
 
 /**
- * Catastrophic targets. These are never handed to JEV: a look-alike approval
+ * Catastrophic targets. These are never handed to Jev: a look-alike approval
  * would be unsafe even when the surrounding conversation seems to ask for it.
  *
  * The list is deliberately small. Everything else belongs to the semantic layer,
@@ -437,7 +437,7 @@ export interface WriteTarget {
  * Classify a write/edit target lexically.
  *
  * A symlink inside the working directory can still point outside it; resolving
- * that needs a filesystem call and belongs to the JEV layer's state building.
+ * that needs a filesystem call and belongs to the Jev layer's state building.
  */
 export function classifyWriteTarget(
   inputPath: string,

package/src/settings.ts

@@ -16,7 +16,7 @@ import { dirname, join } from "node:path";
 
 export interface JevAutoModeSettings {
   readonly enabled: boolean;
-  /** Per-attempt JEV timeout. Kept short: this is a gate, not a batch job. */
+  /** Per-attempt Jev timeout. Kept short: this is a gate, not a batch job. */
   readonly timeoutMs: number;
   /** Retries after the first attempt. */
   readonly maxRetries: number;
@@ -28,6 +28,8 @@ export interface JevAutoModeSettings {
   readonly extraProtectedPaths: readonly string[];
   /** Shared state + questions budget guard, in characters. */
   readonly maxStateCharacters: number;
+  /** What a middle-band judgment means. Default `deny`: no user confirmation. */
+  readonly uncertain: UncertainAction;
   /**
    * Per-rule probability thresholds, overriding the calibrated defaults.
    *
@@ -39,6 +41,18 @@ export interface JevAutoModeSettings {
 
 export type SettingsScope = "global" | "project";
 
+/**
+ * How a judgment that lands in the middle band is resolved.
+ *
+ * `deny` (the default) means the gate never takes over the screen: Jev's probability
+ * is the whole answer, and "not sure" fails closed like every other undecidable
+ * state. `ask` hands the call to the user, which contradicts the point of an auto
+ * mode and is therefore opt-in. `allow` trusts the middle band.
+ */
+export type UncertainAction = "deny" | "ask" | "allow";
+
+export const UNCERTAIN_ACTIONS: readonly UncertainAction[] = ["deny", "ask", "allow"];
+
 export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   enabled: true,
   timeoutMs: 4000,
@@ -48,6 +62,7 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   disallowedCommands: [],
   extraProtectedPaths: [],
   maxStateCharacters: 120_000,
+  uncertain: "deny",
   thresholds: {},
 };
 
@@ -101,6 +116,10 @@ function readThresholds(value: unknown): Readonly<Record<string, number>> | unde
   return thresholds;
 }
 
+export function isUncertainAction(value: unknown): value is UncertainAction {
+  return typeof value === "string" && UNCERTAIN_ACTIONS.includes(value as UncertainAction);
+}
+
 function readBoundedInteger(value: unknown, min: number, max: number): number | undefined {
   if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
   const rounded = Math.round(value);
@@ -140,6 +159,10 @@ export function parseSettingsPatch(value: unknown): SettingsPatch {
   const maxStateCharacters = readBoundedInteger(record.maxStateCharacters, 1000, 1_000_000);
   if (maxStateCharacters !== undefined) patch.maxStateCharacters = maxStateCharacters;
 
+  if (record.uncertain !== undefined && isUncertainAction(record.uncertain)) {
+    patch.uncertain = record.uncertain;
+  }
+
   const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
   if (safeCommands !== undefined) patch.safeCommands = safeCommands;
 
@@ -226,7 +249,7 @@ export class JevAutoModeStore {
     await writeFileAtomic(path, `${JSON.stringify(settings, null, 2)}\n`);
   }
 
-  /** User-authored policy notes. Advisory input to JEV, never a hard rule. */
+  /** User-authored policy notes. Advisory input to Jev, never a hard rule. */
   async loadPolicyNotes(): Promise<string> {
     try {
       return (await readFile(this.policyNotesPath(), "utf8")).slice(0, MAX_POLICY_NOTES_LENGTH);

package/src/ui.ts

@@ -43,9 +43,97 @@ export function describeSettings(settings: JevAutoModeSettings, scope: SettingsS
     `disallowed commands: ${settings.disallowedCommands.length}`,
     `extra protected paths: ${settings.extraProtectedPaths.length}`,
     `max state characters: ${settings.maxStateCharacters}`,
+    `uncertain band: ${settings.uncertain}`,
   ].join("\n");
 }
 
+/**
+ * A bounded rendering of a command, for dialogs.
+ *
+ * Pi's dialogs do not clip their content: a 60-line title fills the pane and pushes
+ * the dialog's own heading off screen, and opening and closing one per tool call
+ * makes the terminal scroll back and forth. So the preview is bounded here, and the
+ * full command stays where it already is — in the tool call above the dialog.
+ */
+export interface CommandPreview {
+  readonly lines: readonly string[];
+  readonly truncated: boolean;
+  readonly hiddenLines: number;
+  readonly hiddenCharacters: number;
+}
+
+export const DEFAULT_PREVIEW_LINES = 6;
+export const DEFAULT_PREVIEW_LINE_LENGTH = 120;
+
+export function previewCommand(
+  command: string,
+  options: { readonly maxLines?: number; readonly maxLineLength?: number } = {},
+): CommandPreview {
+  const maxLines = options.maxLines ?? DEFAULT_PREVIEW_LINES;
+  const maxLineLength = options.maxLineLength ?? DEFAULT_PREVIEW_LINE_LENGTH;
+
+  const all = command.split("\n");
+  const kept = all.slice(0, maxLines);
+  const lines = kept.map((line) => (line.length > maxLineLength ? `${line.slice(0, maxLineLength)}…` : line));
+  const hidden = all.slice(maxLines);
+
+  // A single 4000-character line has no hidden lines, but most of it was still cut.
+  const cutCharacters = kept.reduce((total, line, index) => total + Math.max(0, line.length - (lines[index]?.length ?? 0)), 0);
+  const hiddenCharacters = hidden.reduce((total, line) => total + line.length + 1, 0) + cutCharacters;
+
+  return {
+    lines,
+    truncated: hidden.length > 0 || cutCharacters > 0,
+    hiddenLines: hidden.length,
+    hiddenCharacters,
+  };
+}
+
+/** Cut a text block to a line budget, marking what was dropped. */
+export function clampLines(text: string, maxLines: number): string {
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) return text;
+  return [...lines.slice(0, maxLines - 1), `… (${lines.length - maxLines + 1} more lines)`].join("\n");
+}
+
+export interface ConfirmationParts {
+  readonly tool: string;
+  readonly command?: string;
+  readonly path?: string;
+  readonly reasons: readonly string[];
+  readonly rationale: string;
+}
+
+/** The dialog shown when a judgment is delegated to the user. */
+export const CONFIRMATION_MAX_LINES = 14;
+
+export function buildConfirmationDialog(parts: ConfirmationParts): string {
+  const preview = parts.command === undefined ? undefined : previewCommand(parts.command);
+  const hiddenNote =
+    preview?.truncated === true
+      ? `… ${[
+          preview.hiddenLines > 0 ? `${preview.hiddenLines} more line(s)` : undefined,
+          `${preview.hiddenCharacters} more character(s)`,
+        ]
+          .filter(Boolean)
+          .join(", ")} — the full command is in the tool call above`
+      : undefined;
+
+  return clampLines(
+    [
+      "Jev auto mode wants confirmation before this runs.",
+      `Tool: ${parts.tool}`,
+      ...(preview?.lines ?? []),
+      ...(hiddenNote === undefined ? [] : [hiddenNote]),
+      ...(parts.path === undefined ? [] : [parts.path]),
+      "",
+      `Matched: ${parts.reasons.join(", ")}`,
+      parts.rationale,
+    ].join("\n"),
+    CONFIRMATION_MAX_LINES,
+  );
+}
+
 export const USAGE_TEXT = [
   "Usage:",
   "  /jev-auto-mode                     show status",
@@ -57,10 +145,20 @@ export const USAGE_TEXT = [
   "  /jev-auto-mode threshold           show thresholds and last observed probabilities",
   "  /jev-auto-mode threshold <rule> <0.5-1.0>",
   "  /jev-auto-mode threshold reset [rule]",
+  "  /jev-auto-mode threshold edit      pick a rule and type a value",
+  "  /jev-auto-mode uncertain            show what the middle band resolves to",
+  "  /jev-auto-mode uncertain deny|ask|allow",
+].join("\n");
+
+export const UNCERTAIN_EXPLANATION = [
+  "The middle band is where Jev is neither satisfied nor rejecting.",
+  "  deny  - block it. No prompt, no screen takeover: Jev's probability is the answer.",
+  "  ask   - hand the call to the user. Opt-in, because it hands the decision back to a human.",
+  "  allow - let it through. Trusts the band; the least safe of the three.",
 ].join("\n");
 
 export const POLICY_HEADER = [
-  "# JEV auto mode policy",
+  "# Jev auto mode policy",
   "",
   "Free-form notes describing what this machine and these repositories allow.",
   "They are reference material for the semantic judgment: they can justify an",