pi-jev-auto-mode 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.0
+
+- **The middle band no longer asks the user by default.** An auto mode that stops to ask has
+  handed the decision back to a human, and the agent can always ask in conversation if it needs
+  guidance. A judgment that is neither satisfied nor rejected now blocks, so the gate never
+  takes over the screen.
+- `uncertain` setting and `/jev-auto-mode uncertain deny|ask|allow` control it. `deny` is the
+  default; `ask` restores the confirmation dialog; `allow` trusts the band.
+- `/jev-auto-mode threshold edit` picks a rule and prompts for a value, showing each rule's
+  current threshold next to the last probability the model returned for it.
+
+## 0.1.2
+
+- Fix the screen thrashing that happened whenever a judgment was delegated to the user: the
+  confirmation dialog was handed the whole command, and Pi's dialogs do not clip their content,
+  so a long command produced a dialog taller than the terminal. The dialog now shows a bounded
+  preview and says what was hidden.
+
 ## 0.1.1
 
 - Correct the product name. It is **Jev** — TypeSafe's System One model, spelled with a

package/README.md

@@ -8,7 +8,7 @@ cannot be made.
 
 > **Status: milestones 1–3 are complete.** The deterministic envelope, the Jev engine,
 > real-API calibration, settings, policy notes, per-rule threshold tuning, and decision
-> records are implemented and tested (157 tests, no network). See [`docs/design.md`](./docs/design.md) for
+> records are implemented and tested (171 tests, no network). See [`docs/design.md`](./docs/design.md) for
 > the roadmap and [`docs/calibration.md`](./docs/calibration.md) for the measured
 > probabilities behind every threshold.
 
@@ -26,7 +26,7 @@ your deny pattern       → block
 your allow pattern      → allow
 safe read-only command  → run, no record
 in-project write/edit   → run, no record
-everything else         → Jev: allow · block · confirm · block-if-undecidable
+everything else         → Jev: allow · block · block-if-undecidable
 ```
 
 `rm -rf build` inside the repository is recognized as a scoped local deletion. A write to
@@ -48,8 +48,13 @@ Conditions are phrased so the safe state is "yes", and each one is classified by
 So `intent_coverage` ("is this what the user asked for?") is the permission question, and
 questions like "is a secret being sent to a network endpoint" are hazard detectors that only
 block when they are sure. Posting a private key is never cleared by intent; force-pushing a
-feature branch the user asked for is. Everything that cannot be decided — no engine, timeout,
-malformed response, cancellation — blocks.
+feature branch the user asked for is.
+
+**Nothing is delegated to the user by default.** The middle band — where Jev is neither
+satisfied nor rejecting — resolves to a block, so Jev's probability is the whole answer and the
+gate never takes over the screen. `/jev-auto-mode uncertain ask` restores the confirmation
+dialog if you want it; `allow` trusts the band. Everything else that cannot be decided — no
+engine, timeout, malformed response, cancellation — also blocks.
 
 ## Install
 
@@ -84,7 +89,10 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 /jev-auto-mode policy clear
 /jev-auto-mode threshold                show thresholds and the last observed probability per rule
 /jev-auto-mode threshold <rule> <0.5-1> set one threshold
+/jev-auto-mode threshold edit            pick a rule and type a value
 /jev-auto-mode threshold reset [rule]   restore the calibrated default
+/jev-auto-mode uncertain                show what the middle band resolves to
+/jev-auto-mode uncertain deny|ask|allow
 ```
 
 ```
@@ -164,6 +172,7 @@ Policy notes: `$PI_CODING_AGENT_DIR/jev-auto-mode-policy.md`.
   "disallowedCommands": ["npm publish*"],
   "extraProtectedPaths": [],
   "maxStateCharacters": 120000,
+  "uncertain": "deny",
   "thresholds": {}
 }
 ```

package/docs/design.md

@@ -45,7 +45,8 @@ tool_call(bash | write | edit)
          ├ every `required` condition satisfied, no hazard rejected → allow
          ├ any `hazard` condition rejected    → block
          ├ any `soft` condition rejected      → block, unless the user's own request covers it
-         ├ any `required` condition unclear   → confirm in a UI, block without one
+         ├ any `required` condition unclear   → resolved by the `uncertain` setting
+         │                                      (default: block; `ask` prompts, `allow` passes)
          └ unavailable                        → block (fail-closed)
   └─ 7. record the decision via appendEntry (never enters LLM context)
 ```
@@ -76,7 +77,13 @@ participates:
 
 Composition happens in code, not in the model: one rejection from a `hazard`-severity condition
 blocks, a `soft` rejection is cleared by a satisfied `intent_coverage`, an unclear `required`
-condition escalates, otherwise the call is approved. One question, one judgment; no compound
+condition is resolved by the `uncertain` setting, otherwise the call is approved.
+
+The default for that resolution is `deny`. Handing an unclear judgment to the user is what a
+non-auto mode does, and it makes the gate a source of interruptions; the agent can ask in
+conversation if it needs guidance. The `ask` path still exists, and when it is used the dialog
+shows a bounded preview — Pi's dialogs do not clip their content, so an unbounded command
+produces a dialog taller than the terminal. One question, one judgment; no compound
 questions, and the model never has to weigh concerns against each other.
 
 `intent_coverage` is the only permission question. It reads user-authored messages only — never
@@ -98,7 +105,7 @@ shipped to everyone.
 
 ## Tests
 
-157 tests, none of which need a network or an API key: the engine and transport are stubbed so
+171 tests, none of which need a network or an API key: the engine and transport are stubbed so
 every branch — allow, deny, cleared-by-intent, uncertain, each unavailable reason, boundary
 probabilities — is deterministic. The real API is exercised by two scripts that are not part of
 the published package:

package/docs/security.md

@@ -60,7 +60,9 @@ Everything below resolves to **block**. Silence is never consent.
 | State + questions over the shared budget | block (`state_too_large`) before the request is sent |
 | Engine throws | block (`engine_error`) |
 | Request cancelled (Esc) | block |
-| No UI available for a confirmation | block (`no-ui`) |
+| A middle-band judgment, with the default `uncertain: deny` | block (`uncertain`) |
+| A middle-band judgment with `uncertain: allow` | allow — an explicit choice to trust the band |
+| No UI available for a confirmation when `uncertain: ask` | block (`no-ui`) |
 | A condition answered by fewer than all keys | block (`malformed_response`) — a missing answer is never an approval |
 
 A confirmation is not a bypass: it runs only when the semantic layer said `uncertain`, never

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",

package/src/decide.ts

@@ -9,7 +9,7 @@
 
 import type { GatedCall, RepoFacts } from "./call.ts";
 
-export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "unavailable" | "no-ui" | "user";
+export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "uncertain" | "unavailable" | "no-ui" | "user";
 
 /**
  * A display-ready report of one condition's judgment.

package/src/extension.ts

@@ -51,9 +51,18 @@ import {
   type DecisionRecord,
   type DecisionRecorder,
 } from "./records.ts";
-import { DEFAULT_SETTINGS, JevAutoModeStore, parseThreshold, type JevAutoModeSettings, type SettingsScope } from "./settings.ts";
 import {
+  DEFAULT_SETTINGS,
+  JevAutoModeStore,
+  isUncertainAction,
+  parseThreshold,
+  type JevAutoModeSettings,
+  type SettingsScope,
+} from "./settings.ts";
+import {
+  buildConfirmationDialog,
   describeSettings,
+  UNCERTAIN_EXPLANATION,
   formatRuleTable,
   POLICY_HEADER,
   statusText,
@@ -308,6 +317,32 @@ export async function evaluateToolCall(
     }
 
     case "uncertain": {
+      // The middle band is a policy decision, not a prompt by default. An auto mode
+      // that stops to ask the user has handed the decision back to the human, and
+      // the agent can always ask in conversation if it needs guidance.
+      if (state.settings.uncertain === "deny") {
+        const rationale = `No condition decided the call, and the uncertain band is resolved to a block. ${verdict.rationale}`;
+        return blocked(deps, {
+          call,
+          reasons,
+          status: "blocked",
+          source: "uncertain",
+          rationale,
+          evidence,
+        });
+      }
+
+      if (state.settings.uncertain === "allow") {
+        return permit(deps, {
+          call,
+          reasons,
+          status: "allowed",
+          source: "uncertain",
+          rationale: `No condition was violated and the uncertain band is configured to allow. ${verdict.rationale}`,
+          evidence,
+        });
+      }
+
       if (!ctx.hasUI) {
         const rationale = `${verdict.rationale} No UI is available to confirm, so the call was blocked.`;
         return blocked(
@@ -317,16 +352,13 @@ export async function evaluateToolCall(
         );
       }
 
-      const dialog = [
-        "Jev auto mode wants confirmation before this runs.",
-        "",
-        `Tool: ${call.tool}`,
-        ...(call.command ? [call.command] : []),
-        ...(call.path ? [call.path] : []),
-        "",
-        `Matched: ${reasons.join(", ")}`,
-        `Rationale: ${verdict.rationale}`,
-      ].join("\n");
+      const dialog = buildConfirmationDialog({
+        tool: call.tool,
+        ...(call.command === undefined ? {} : { command: call.command }),
+        ...(call.path === undefined ? {} : { path: call.path }),
+        reasons,
+        rationale: verdict.rationale,
+      });
 
       const choice = await ctx.ui.select(dialog, ["No", "Yes"]);
       if (choice !== "Yes") {
@@ -353,6 +385,47 @@ export async function evaluateToolCall(
   }
 }
 
+/**
+ * Pick a rule, then type a value.
+ *
+ * The direct form (`threshold <rule> <value>`) is faster once the rule ids are
+ * known; this exists so tuning does not require remembering them.
+ */
+async function editThreshold(
+  ctx: { ui: GateUi },
+  state: GateState,
+  observed: ReadonlyMap<string, ObservedCondition>,
+  save: (ctx: GateContext) => Promise<void>,
+  rebuild: () => Promise<void>,
+): Promise<void> {
+  const choices = DEFAULT_RULES.map((rule) => {
+    const threshold = state.settings.thresholds[rule.id] ?? rule.threshold;
+    const last = observed.get(rule.id);
+    return `${rule.id}  (t=${threshold}${last ? `, last p=${last.probability.toFixed(2)}` : ""})`;
+  });
+
+  const picked = await ctx.ui.select("Which condition?", choices);
+  if (picked === undefined) return;
+  const ruleId = picked.split(" ")[0] ?? "";
+  const rule = ruleById(ruleId);
+  if (!rule) return;
+
+  const current = state.settings.thresholds[ruleId] ?? rule.threshold;
+  const entered = await ctx.ui.input(`${ruleId}: threshold (0.5-1.0, default ${rule.threshold})`, String(current));
+  if (entered === undefined) return;
+
+  const threshold = parseThreshold(Number(entered.trim()));
+  if (threshold === undefined) {
+    ctx.ui.notify(`A threshold must be greater than 0.5 and at most 1.0 (got \`${entered.trim()}\`).`, "error");
+    return;
+  }
+
+  state.settings = { ...state.settings, thresholds: { ...state.settings.thresholds, [ruleId]: threshold } };
+  await save(ctx as unknown as GateContext);
+  await rebuild();
+  ctx.ui.notify(`\`${ruleId}\` now requires p >= ${threshold}`, "info");
+}
+
 export interface RegisterOptions {
   /** Override the engine (tests, or a different judgment backend). */
   readonly engine?: DecisionEngine;
@@ -616,6 +689,28 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         return;
       }
 
+      if (value === "threshold edit") {
+        await editThreshold(ctx, state, observed, save, rebuildEngine);
+        return;
+      }
+
+      if (value.startsWith("uncertain")) {
+        const argument = value.slice("uncertain".length).trim();
+        if (argument === "") {
+          ctx.ui.notify(`uncertain: ${state.settings.uncertain}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+          return;
+        }
+        if (!isUncertainAction(argument)) {
+          ctx.ui.notify(`Expected one of deny, ask, allow.\n\n${UNCERTAIN_EXPLANATION}`, "error");
+          return;
+        }
+
+        state.settings = { ...state.settings, uncertain: argument };
+        await save(gateContext);
+        ctx.ui.notify(`uncertain band now resolves to: ${argument}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+        return;
+      }
+
       const thresholdMatch = /^threshold\s+(\S+)(?:\s+(\S+))?$/.exec(value);
       if (thresholdMatch) {
         const ruleId = thresholdMatch[1] ?? "";

package/src/settings.ts

@@ -28,6 +28,8 @@ export interface JevAutoModeSettings {
   readonly extraProtectedPaths: readonly string[];
   /** Shared state + questions budget guard, in characters. */
   readonly maxStateCharacters: number;
+  /** What a middle-band judgment means. Default `deny`: no user confirmation. */
+  readonly uncertain: UncertainAction;
   /**
    * Per-rule probability thresholds, overriding the calibrated defaults.
    *
@@ -39,6 +41,18 @@ export interface JevAutoModeSettings {
 
 export type SettingsScope = "global" | "project";
 
+/**
+ * How a judgment that lands in the middle band is resolved.
+ *
+ * `deny` (the default) means the gate never takes over the screen: Jev's probability
+ * is the whole answer, and "not sure" fails closed like every other undecidable
+ * state. `ask` hands the call to the user, which contradicts the point of an auto
+ * mode and is therefore opt-in. `allow` trusts the middle band.
+ */
+export type UncertainAction = "deny" | "ask" | "allow";
+
+export const UNCERTAIN_ACTIONS: readonly UncertainAction[] = ["deny", "ask", "allow"];
+
 export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   enabled: true,
   timeoutMs: 4000,
@@ -48,6 +62,7 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   disallowedCommands: [],
   extraProtectedPaths: [],
   maxStateCharacters: 120_000,
+  uncertain: "deny",
   thresholds: {},
 };
 
@@ -101,6 +116,10 @@ function readThresholds(value: unknown): Readonly<Record<string, number>> | unde
   return thresholds;
 }
 
+export function isUncertainAction(value: unknown): value is UncertainAction {
+  return typeof value === "string" && UNCERTAIN_ACTIONS.includes(value as UncertainAction);
+}
+
 function readBoundedInteger(value: unknown, min: number, max: number): number | undefined {
   if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
   const rounded = Math.round(value);
@@ -140,6 +159,10 @@ export function parseSettingsPatch(value: unknown): SettingsPatch {
   const maxStateCharacters = readBoundedInteger(record.maxStateCharacters, 1000, 1_000_000);
   if (maxStateCharacters !== undefined) patch.maxStateCharacters = maxStateCharacters;
 
+  if (record.uncertain !== undefined && isUncertainAction(record.uncertain)) {
+    patch.uncertain = record.uncertain;
+  }
+
   const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
   if (safeCommands !== undefined) patch.safeCommands = safeCommands;
 

package/src/ui.ts

@@ -43,9 +43,97 @@ export function describeSettings(settings: JevAutoModeSettings, scope: SettingsS
     `disallowed commands: ${settings.disallowedCommands.length}`,
     `extra protected paths: ${settings.extraProtectedPaths.length}`,
     `max state characters: ${settings.maxStateCharacters}`,
+    `uncertain band: ${settings.uncertain}`,
   ].join("\n");
 }
 
+/**
+ * A bounded rendering of a command, for dialogs.
+ *
+ * Pi's dialogs do not clip their content: a 60-line title fills the pane and pushes
+ * the dialog's own heading off screen, and opening and closing one per tool call
+ * makes the terminal scroll back and forth. So the preview is bounded here, and the
+ * full command stays where it already is — in the tool call above the dialog.
+ */
+export interface CommandPreview {
+  readonly lines: readonly string[];
+  readonly truncated: boolean;
+  readonly hiddenLines: number;
+  readonly hiddenCharacters: number;
+}
+
+export const DEFAULT_PREVIEW_LINES = 6;
+export const DEFAULT_PREVIEW_LINE_LENGTH = 120;
+
+export function previewCommand(
+  command: string,
+  options: { readonly maxLines?: number; readonly maxLineLength?: number } = {},
+): CommandPreview {
+  const maxLines = options.maxLines ?? DEFAULT_PREVIEW_LINES;
+  const maxLineLength = options.maxLineLength ?? DEFAULT_PREVIEW_LINE_LENGTH;
+
+  const all = command.split("\n");
+  const kept = all.slice(0, maxLines);
+  const lines = kept.map((line) => (line.length > maxLineLength ? `${line.slice(0, maxLineLength)}…` : line));
+  const hidden = all.slice(maxLines);
+
+  // A single 4000-character line has no hidden lines, but most of it was still cut.
+  const cutCharacters = kept.reduce((total, line, index) => total + Math.max(0, line.length - (lines[index]?.length ?? 0)), 0);
+  const hiddenCharacters = hidden.reduce((total, line) => total + line.length + 1, 0) + cutCharacters;
+
+  return {
+    lines,
+    truncated: hidden.length > 0 || cutCharacters > 0,
+    hiddenLines: hidden.length,
+    hiddenCharacters,
+  };
+}
+
+/** Cut a text block to a line budget, marking what was dropped. */
+export function clampLines(text: string, maxLines: number): string {
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) return text;
+  return [...lines.slice(0, maxLines - 1), `… (${lines.length - maxLines + 1} more lines)`].join("\n");
+}
+
+export interface ConfirmationParts {
+  readonly tool: string;
+  readonly command?: string;
+  readonly path?: string;
+  readonly reasons: readonly string[];
+  readonly rationale: string;
+}
+
+/** The dialog shown when a judgment is delegated to the user. */
+export const CONFIRMATION_MAX_LINES = 14;
+
+export function buildConfirmationDialog(parts: ConfirmationParts): string {
+  const preview = parts.command === undefined ? undefined : previewCommand(parts.command);
+  const hiddenNote =
+    preview?.truncated === true
+      ? `… ${[
+          preview.hiddenLines > 0 ? `${preview.hiddenLines} more line(s)` : undefined,
+          `${preview.hiddenCharacters} more character(s)`,
+        ]
+          .filter(Boolean)
+          .join(", ")} — the full command is in the tool call above`
+      : undefined;
+
+  return clampLines(
+    [
+      "Jev auto mode wants confirmation before this runs.",
+      `Tool: ${parts.tool}`,
+      ...(preview?.lines ?? []),
+      ...(hiddenNote === undefined ? [] : [hiddenNote]),
+      ...(parts.path === undefined ? [] : [parts.path]),
+      "",
+      `Matched: ${parts.reasons.join(", ")}`,
+      parts.rationale,
+    ].join("\n"),
+    CONFIRMATION_MAX_LINES,
+  );
+}
+
 export const USAGE_TEXT = [
   "Usage:",
   "  /jev-auto-mode                     show status",
@@ -57,6 +145,16 @@ export const USAGE_TEXT = [
   "  /jev-auto-mode threshold           show thresholds and last observed probabilities",
   "  /jev-auto-mode threshold <rule> <0.5-1.0>",
   "  /jev-auto-mode threshold reset [rule]",
+  "  /jev-auto-mode threshold edit      pick a rule and type a value",
+  "  /jev-auto-mode uncertain            show what the middle band resolves to",
+  "  /jev-auto-mode uncertain deny|ask|allow",
+].join("\n");
+
+export const UNCERTAIN_EXPLANATION = [
+  "The middle band is where Jev is neither satisfied nor rejecting.",
+  "  deny  - block it. No prompt, no screen takeover: Jev's probability is the answer.",
+  "  ask   - hand the call to the user. Opt-in, because it hands the decision back to a human.",
+  "  allow - let it through. Trusts the band; the least safe of the three.",
 ].join("\n");
 
 export const POLICY_HEADER = [