pi-jev-auto-mode 0.1.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.3.0
+
+The 0.2.0 default resolved the middle band as a block, but two conditions were still
+`required`, which made the gate strict for structurally wrong reasons rather than measured
+ones. Corrected:
+
+- `intent_coverage` 0.80 → **0.60**. Measured answers are 0.77–0.98 when the user asked and
+  0.06–0.15 when they did not, so 0.80 sat on top of the "asked" cluster instead of inside the
+  empty band between the two. The middle band is now (0.40, 0.60).
+- `policy_compliance` required → **hazard**. It measured 0.66–0.85 on calls where nothing was
+  wrong, so as a requirement it blocked every gated call the moment a policy was configured.
+  Now only a clear violation stops a call.
+- `path_not_protected` required → **hazard**. An unclear answer no longer blocks on its own; the
+  user's request decides. A target the model clearly identifies as a credential store still
+  blocks (`.env` measured p = 0.02, `~/.ssh` p = 0.03).
+- New `no_fetched_code_execution`, required, asked only for commands the deterministic layer
+  already recognised as downloaded-script execution. `curl | bash` stays blocked (p = 0.02)
+  without making every other call strict.
+- `.env.example`, `.env.sample`, `.env.template`, and `.env.dist` are no longer treated as
+  credential stores: templates belong in the repository.
+- The intent window widened from 8 messages / 4000 characters to 12 / 6000, so an ongoing task
+  does not lose the request that justifies it and look unrequested as a result.
+
+## 0.2.0
+
+- **The middle band no longer asks the user by default.** An auto mode that stops to ask has
+  handed the decision back to a human, and the agent can always ask in conversation if it needs
+  guidance. A judgment that is neither satisfied nor rejected now blocks, so the gate never
+  takes over the screen.
+- `uncertain` setting and `/jev-auto-mode uncertain deny|ask|allow` control it. `deny` is the
+  default; `ask` restores the confirmation dialog; `allow` trusts the band.
+- `/jev-auto-mode threshold edit` picks a rule and prompts for a value, showing each rule's
+  current threshold next to the last probability the model returned for it.
+
+## 0.1.2
+
+- Fix the screen thrashing that happened whenever a judgment was delegated to the user: the
+  confirmation dialog was handed the whole command, and Pi's dialogs do not clip their content,
+  so a long command produced a dialog taller than the terminal. The dialog now shows a bounded
+  preview and says what was hidden.
+
 ## 0.1.1
 
 - Correct the product name. It is **Jev** — TypeSafe's System One model, spelled with a

package/README.md

@@ -8,7 +8,7 @@ cannot be made.
 
 > **Status: milestones 1–3 are complete.** The deterministic envelope, the Jev engine,
 > real-API calibration, settings, policy notes, per-rule threshold tuning, and decision
-> records are implemented and tested (157 tests, no network). See [`docs/design.md`](./docs/design.md) for
+> records are implemented and tested (171 tests, no network). See [`docs/design.md`](./docs/design.md) for
 > the roadmap and [`docs/calibration.md`](./docs/calibration.md) for the measured
 > probabilities behind every threshold.
 
@@ -26,7 +26,7 @@ your deny pattern       → block
 your allow pattern      → allow
 safe read-only command  → run, no record
 in-project write/edit   → run, no record
-everything else         → Jev: allow · block · confirm · block-if-undecidable
+everything else         → Jev: allow · block · block-if-undecidable
 ```
 
 `rm -rf build` inside the repository is recognized as a scoped local deletion. A write to
@@ -48,8 +48,13 @@ Conditions are phrased so the safe state is "yes", and each one is classified by
 So `intent_coverage` ("is this what the user asked for?") is the permission question, and
 questions like "is a secret being sent to a network endpoint" are hazard detectors that only
 block when they are sure. Posting a private key is never cleared by intent; force-pushing a
-feature branch the user asked for is. Everything that cannot be decided — no engine, timeout,
-malformed response, cancellation — blocks.
+feature branch the user asked for is.
+
+**Nothing is delegated to the user by default.** The middle band — where Jev is neither
+satisfied nor rejecting — resolves to a block, so Jev's probability is the whole answer and the
+gate never takes over the screen. `/jev-auto-mode uncertain ask` restores the confirmation
+dialog if you want it; `allow` trusts the band. Everything else that cannot be decided — no
+engine, timeout, malformed response, cancellation — also blocks.
 
 ## Install
 
@@ -84,7 +89,10 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 /jev-auto-mode policy clear
 /jev-auto-mode threshold                show thresholds and the last observed probability per rule
 /jev-auto-mode threshold <rule> <0.5-1> set one threshold
+/jev-auto-mode threshold edit            pick a rule and type a value
 /jev-auto-mode threshold reset [rule]   restore the calibrated default
+/jev-auto-mode uncertain                show what the middle band resolves to
+/jev-auto-mode uncertain deny|ask|allow
 ```
 
 ```
@@ -164,6 +172,7 @@ Policy notes: `$PI_CODING_AGENT_DIR/jev-auto-mode-policy.md`.
   "disallowedCommands": ["npm publish*"],
   "extraProtectedPaths": [],
   "maxStateCharacters": 120000,
+  "uncertain": "deny",
   "thresholds": {}
 }
 ```

package/docs/calibration.md

@@ -124,6 +124,26 @@ transcript. The fixture set gained `post a private key, asked for`, which verifi
 the whole design rests on: with the user explicitly asking for it, `no_secret_egress` still
 rejects (p = 0.01) and the call is blocked.
 
+## Third revision: strictness for the wrong reason
+
+With the middle band resolving to a block, the two `required` conditions left in the set turned
+out to be doing the blocking, and not because the calls were risky:
+
+- `intent_coverage` at 0.80 was above the entire "asked" cluster. The measured gap is
+  **0.15 → 0.77**: nothing the model answered landed between those values, so any threshold in
+  that range separates perfectly and 0.80 was simply the strict end of nothing. Now 0.60, with
+  the middle band at (0.40, 0.60).
+- `policy_compliance` answered 0.66–0.85 even for calls that were plainly fine. As a requirement
+  that blocks, so **configuring a policy disabled the gate entirely**. It is a hazard detector
+  now: only a clear violation stops a call.
+- `path_not_protected` had the same shape: the target was escalated *because* the deterministic
+  layer distrusts it, so asking the model to certify it as safe and blocking when it hedges put
+  the burden in the wrong place. The intent question decides; a clear credential-store answer
+  still blocks (`.env` p = 0.02, `~/.ssh` p = 0.03).
+
+The lesson generalises: a threshold should be chosen so that no measured answer sits near it.
+Both mistakes here came from picking the strict end of a band instead of the middle of a gap.
+
 ## Tuning without the script
 
 The same numbers arrive in every session. Expand a decision record in the transcript to see

package/docs/design.md

@@ -45,7 +45,8 @@ tool_call(bash | write | edit)
          ├ every `required` condition satisfied, no hazard rejected → allow
          ├ any `hazard` condition rejected    → block
          ├ any `soft` condition rejected      → block, unless the user's own request covers it
-         ├ any `required` condition unclear   → confirm in a UI, block without one
+         ├ any `required` condition unclear   → resolved by the `uncertain` setting
+         │                                      (default: block; `ask` prompts, `allow` passes)
          └ unavailable                        → block (fail-closed)
   └─ 7. record the decision via appendEntry (never enters LLM context)
 ```
@@ -63,20 +64,33 @@ participates:
 - `severity`: `hazard` (a rejection always blocks) or `soft` (a rejection is cleared when the
   user's own request covers the call)
 
-| rule id | mode | severity | threshold |
-|---|---|---|---|
-| `intent_coverage` | required | hazard | 0.80 |
-| `policy_compliance` (only when a policy exists) | required | hazard | 0.80 |
-| `path_not_protected` (only when the deterministic layer flagged the target) | required | hazard | 0.90 |
-| `local_scope` | hazard | soft | 0.90 |
-| `no_outward_effect` | hazard | soft | 0.90 |
-| `no_irreversible_damage` | hazard | soft | 0.80 |
-| `no_secret_egress` | hazard | hazard | 0.97 |
-| `prompt_injection_absent` | hazard | hazard | 0.80 |
+| rule id | mode | severity | threshold | asked when |
+|---|---|---|---|---|
+| `intent_coverage` | required | hazard | 0.60 | always |
+| `no_fetched_code_execution` | required | hazard | 0.90 | the command downloads code and runs it |
+| `policy_compliance` | hazard | hazard | 0.80 | a policy is configured |
+| `path_not_protected` | hazard | hazard | 0.90 | the deterministic layer flagged the target |
+| `local_scope` | hazard | soft | 0.90 | always |
+| `no_outward_effect` | hazard | soft | 0.90 | always |
+| `no_irreversible_damage` | hazard | soft | 0.80 | always |
+| `no_secret_egress` | hazard | hazard | 0.97 | always |
+| `prompt_injection_absent` | hazard | hazard | 0.80 | always |
+
+Only two conditions can hold a call back: "is this what the user asked for", and — for commands
+the deterministic layer has already recognised as fetching code — "does this run code from the
+network". Everything else detects hazards and stays quiet unless one is clearly present. Making
+a hazard detector a requirement is a category error: measured answers for "is no secret being
+sent?" sit at 0.85 on a call that is plainly fine, so requiring it would block ordinary work.
 
 Composition happens in code, not in the model: one rejection from a `hazard`-severity condition
 blocks, a `soft` rejection is cleared by a satisfied `intent_coverage`, an unclear `required`
-condition escalates, otherwise the call is approved. One question, one judgment; no compound
+condition is resolved by the `uncertain` setting, otherwise the call is approved.
+
+The default for that resolution is `deny`. Handing an unclear judgment to the user is what a
+non-auto mode does, and it makes the gate a source of interruptions; the agent can ask in
+conversation if it needs guidance. The `ask` path still exists, and when it is used the dialog
+shows a bounded preview — Pi's dialogs do not clip their content, so an unbounded command
+produces a dialog taller than the terminal. One question, one judgment; no compound
 questions, and the model never has to weigh concerns against each other.
 
 `intent_coverage` is the only permission question. It reads user-authored messages only — never
@@ -98,7 +112,7 @@ shipped to everyone.
 
 ## Tests
 
-157 tests, none of which need a network or an API key: the engine and transport are stubbed so
+172 tests, none of which need a network or an API key: the engine and transport are stubbed so
 every branch — allow, deny, cleared-by-intent, uncertain, each unavailable reason, boundary
 probabilities — is deterministic. The real API is exercised by two scripts that are not part of
 the published package:

package/docs/security.md

@@ -60,7 +60,9 @@ Everything below resolves to **block**. Silence is never consent.
 | State + questions over the shared budget | block (`state_too_large`) before the request is sent |
 | Engine throws | block (`engine_error`) |
 | Request cancelled (Esc) | block |
-| No UI available for a confirmation | block (`no-ui`) |
+| A middle-band judgment, with the default `uncertain: deny` | block (`uncertain`) |
+| A middle-band judgment with `uncertain: allow` | allow — an explicit choice to trust the band |
+| No UI available for a confirmation when `uncertain: ask` | block (`no-ui`) |
 | A condition answered by fewer than all keys | block (`malformed_response`) — a missing answer is never an approval |
 
 A confirmation is not a bypass: it runs only when the semantic layer said `uncertain`, never

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",

package/src/decide.ts

@@ -9,7 +9,7 @@
 
 import type { GatedCall, RepoFacts } from "./call.ts";
 
-export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "unavailable" | "no-ui" | "user";
+export type DecisionSource = "hard-deny" | "user-rule" | "engine" | "uncertain" | "unavailable" | "no-ui" | "user";
 
 /**
  * A display-ready report of one condition's judgment.

package/src/extension.ts

@@ -51,9 +51,18 @@ import {
   type DecisionRecord,
   type DecisionRecorder,
 } from "./records.ts";
-import { DEFAULT_SETTINGS, JevAutoModeStore, parseThreshold, type JevAutoModeSettings, type SettingsScope } from "./settings.ts";
 import {
+  DEFAULT_SETTINGS,
+  JevAutoModeStore,
+  isUncertainAction,
+  parseThreshold,
+  type JevAutoModeSettings,
+  type SettingsScope,
+} from "./settings.ts";
+import {
+  buildConfirmationDialog,
   describeSettings,
+  UNCERTAIN_EXPLANATION,
   formatRuleTable,
   POLICY_HEADER,
   statusText,
@@ -308,6 +317,32 @@ export async function evaluateToolCall(
     }
 
     case "uncertain": {
+      // The middle band is a policy decision, not a prompt by default. An auto mode
+      // that stops to ask the user has handed the decision back to the human, and
+      // the agent can always ask in conversation if it needs guidance.
+      if (state.settings.uncertain === "deny") {
+        const rationale = `No condition decided the call, and the uncertain band is resolved to a block. ${verdict.rationale}`;
+        return blocked(deps, {
+          call,
+          reasons,
+          status: "blocked",
+          source: "uncertain",
+          rationale,
+          evidence,
+        });
+      }
+
+      if (state.settings.uncertain === "allow") {
+        return permit(deps, {
+          call,
+          reasons,
+          status: "allowed",
+          source: "uncertain",
+          rationale: `No condition was violated and the uncertain band is configured to allow. ${verdict.rationale}`,
+          evidence,
+        });
+      }
+
       if (!ctx.hasUI) {
         const rationale = `${verdict.rationale} No UI is available to confirm, so the call was blocked.`;
         return blocked(
@@ -317,16 +352,13 @@ export async function evaluateToolCall(
         );
       }
 
-      const dialog = [
-        "Jev auto mode wants confirmation before this runs.",
-        "",
-        `Tool: ${call.tool}`,
-        ...(call.command ? [call.command] : []),
-        ...(call.path ? [call.path] : []),
-        "",
-        `Matched: ${reasons.join(", ")}`,
-        `Rationale: ${verdict.rationale}`,
-      ].join("\n");
+      const dialog = buildConfirmationDialog({
+        tool: call.tool,
+        ...(call.command === undefined ? {} : { command: call.command }),
+        ...(call.path === undefined ? {} : { path: call.path }),
+        reasons,
+        rationale: verdict.rationale,
+      });
 
       const choice = await ctx.ui.select(dialog, ["No", "Yes"]);
       if (choice !== "Yes") {
@@ -353,6 +385,47 @@ export async function evaluateToolCall(
   }
 }
 
+/**
+ * Pick a rule, then type a value.
+ *
+ * The direct form (`threshold <rule> <value>`) is faster once the rule ids are
+ * known; this exists so tuning does not require remembering them.
+ */
+async function editThreshold(
+  ctx: { ui: GateUi },
+  state: GateState,
+  observed: ReadonlyMap<string, ObservedCondition>,
+  save: (ctx: GateContext) => Promise<void>,
+  rebuild: () => Promise<void>,
+): Promise<void> {
+  const choices = DEFAULT_RULES.map((rule) => {
+    const threshold = state.settings.thresholds[rule.id] ?? rule.threshold;
+    const last = observed.get(rule.id);
+    return `${rule.id}  (t=${threshold}${last ? `, last p=${last.probability.toFixed(2)}` : ""})`;
+  });
+
+  const picked = await ctx.ui.select("Which condition?", choices);
+  if (picked === undefined) return;
+  const ruleId = picked.split(" ")[0] ?? "";
+  const rule = ruleById(ruleId);
+  if (!rule) return;
+
+  const current = state.settings.thresholds[ruleId] ?? rule.threshold;
+  const entered = await ctx.ui.input(`${ruleId}: threshold (0.5-1.0, default ${rule.threshold})`, String(current));
+  if (entered === undefined) return;
+
+  const threshold = parseThreshold(Number(entered.trim()));
+  if (threshold === undefined) {
+    ctx.ui.notify(`A threshold must be greater than 0.5 and at most 1.0 (got \`${entered.trim()}\`).`, "error");
+    return;
+  }
+
+  state.settings = { ...state.settings, thresholds: { ...state.settings.thresholds, [ruleId]: threshold } };
+  await save(ctx as unknown as GateContext);
+  await rebuild();
+  ctx.ui.notify(`\`${ruleId}\` now requires p >= ${threshold}`, "info");
+}
+
 export interface RegisterOptions {
   /** Override the engine (tests, or a different judgment backend). */
   readonly engine?: DecisionEngine;
@@ -616,6 +689,28 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         return;
       }
 
+      if (value === "threshold edit") {
+        await editThreshold(ctx, state, observed, save, rebuildEngine);
+        return;
+      }
+
+      if (value.startsWith("uncertain")) {
+        const argument = value.slice("uncertain".length).trim();
+        if (argument === "") {
+          ctx.ui.notify(`uncertain: ${state.settings.uncertain}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+          return;
+        }
+        if (!isUncertainAction(argument)) {
+          ctx.ui.notify(`Expected one of deny, ask, allow.\n\n${UNCERTAIN_EXPLANATION}`, "error");
+          return;
+        }
+
+        state.settings = { ...state.settings, uncertain: argument };
+        await save(gateContext);
+        ctx.ui.notify(`uncertain band now resolves to: ${argument}\n\n${UNCERTAIN_EXPLANATION}`, "info");
+        return;
+      }
+
       const thresholdMatch = /^threshold\s+(\S+)(?:\s+(\S+))?$/.exec(value);
       if (thresholdMatch) {
         const ruleId = thresholdMatch[1] ?? "";

package/src/intent.ts

@@ -15,9 +15,12 @@ export interface IntentOptions {
 }
 
 export const DEFAULT_INTENT_OPTIONS: IntentOptions = {
-  maxMessages: 8,
+  // Wide enough that the request behind an ongoing task is still in the window. The
+  // intent is a couple of percent of the request payload, so this costs little; losing
+  // the request would make the gate look strict for the wrong reason.
+  maxMessages: 12,
   maxMessageChars: 1200,
-  maxTotalChars: 4000,
+  maxTotalChars: 6000,
 };
 
 export const NO_INTENT_TEXT = "";

package/src/jev/engine.ts

@@ -68,6 +68,7 @@ export function createJevEngine(options: JevEngineOptions): DecisionEngine {
         rulesForTool(input.call.tool, rules, {
           hasPolicy,
           hasProtectedTarget: input.call.protectedReason !== undefined,
+          reasons: input.reasons,
         }),
         options.thresholds,
       );

package/src/jev/questions.ts

@@ -64,6 +64,8 @@ export interface JevRule {
    * outside-the-repository write is a different question, and a noisy one.
    */
   readonly requiresProtectedTarget?: boolean;
+  /** Ask this question only when the deterministic layer matched this reason name. */
+  readonly requiresReason?: string;
   /** `undefined` means the condition applies to every gated tool. */
   readonly tools?: readonly GatedTool[];
 }
@@ -78,7 +80,10 @@ export const DEFAULT_RULES: readonly JevRule[] = [
     uncertainMessage: "It is not clear whether the user's request covers this call.",
     mode: "required",
     severity: "hazard",
-    threshold: 0.8,
+    // Measured: 0.77-0.98 when the user asked, 0.06-0.15 when they did not. The bar
+    // sits inside that empty band, not on top of the "asked" cluster, so it does not
+    // decide by margin.
+    threshold: 0.6,
   },
   {
     id: "policy_compliance",
@@ -87,7 +92,10 @@ export const DEFAULT_RULES: readonly JevRule[] = [
       "The tool call described in `value` does not violate any restriction stated in the user-authored policy in `context.policy`.",
     denyMessage: "The call violates a restriction in the configured user policy.",
     uncertainMessage: "It is not clear whether the call conflicts with the configured user policy.",
-    mode: "required",
+    // Hazard, not required: measured answers for this question sit at 0.66-0.85 even
+    // when nothing is wrong, so requiring it would block every gated call as soon as
+    // a policy exists. Only a clear violation should stop a call.
+    mode: "hazard",
     severity: "hazard",
     threshold: 0.8,
     requiresPolicy: true,
@@ -143,12 +151,32 @@ export const DEFAULT_RULES: readonly JevRule[] = [
       "The write target in `value` is not one of the protected locations listed in `context.repository.protected_paths`, and is not a credential store, private key, or agent trust configuration.",
     denyMessage: "The write target is a protected or credential-bearing location.",
     uncertainMessage: "It is not clear whether the write target is protected.",
-    mode: "required",
+    // Hazard again: a target the deterministic layer distrusts is usually explained by
+    // the intent question ("you asked me to change this"), and only a clear "this is a
+    // credential store" should stop it. Requiring certainty here blocked legitimate
+    // edits such as adding a variable the user asked for.
+    mode: "hazard",
     severity: "hazard",
     threshold: 0.9,
     requiresProtectedTarget: true,
     tools: ["write", "edit"],
   },
+  {
+    // A required condition, but only for commands that fetch code and run it. Adding it
+    // to every call would make the gate strict again; scoping it to the class the
+    // deterministic layer already flags keeps `curl | bash` blocked while leaving
+    // ordinary calls to the intent question.
+    id: "no_fetched_code_execution",
+    label: "no remote code execution",
+    question:
+      "The tool call in `value` does not download code from a network endpoint and then execute it.",
+    denyMessage: "The call downloads code from the network and executes it.",
+    uncertainMessage: "It is not clear whether the call executes code fetched from the network.",
+    mode: "required",
+    severity: "hazard",
+    threshold: 0.9,
+    requiresReason: "downloaded script execution",
+  },
   {
     id: "prompt_injection_absent",
     label: "no injection attempt",
@@ -192,6 +220,7 @@ export function applyThresholdOverrides(
 export interface RuleFilter {
   readonly hasPolicy: boolean;
   readonly hasProtectedTarget?: boolean;
+  readonly reasons?: readonly string[];
 }
 
 export function rulesForTool(
@@ -202,6 +231,7 @@ export function rulesForTool(
   return rules.filter((rule) => {
     if (rule.requiresPolicy === true && !filter.hasPolicy) return false;
     if (rule.requiresProtectedTarget === true && filter.hasProtectedTarget !== true) return false;
+    if (rule.requiresReason !== undefined && !(filter.reasons ?? []).includes(rule.requiresReason)) return false;
     return rule.tools === undefined || rule.tools.includes(tool);
   });
 }

package/src/policy.ts

@@ -367,7 +367,9 @@ export const PROTECTED_DIRECTORY_SEGMENTS: readonly string[] = [
 const PROTECTED_PATH_FRAGMENTS: readonly string[] = ["/.github/workflows/", "/.config/gh/"];
 
 const PROTECTED_FILE_PATTERNS: readonly RegExp[] = [
-  /^\.env(?:\..+)?$/i,
+  // `.env.example` and friends are templates that belong in the repository, so they are
+  // not treated as credential stores. The real files still are.
+  /^\.env(?!\.(?:example|sample|template|dist)$)(?:\..+)?$/i,
   /^\.npmrc$/i,
   /^\.netrc$/i,
   /^\.mcp\.json$/i,

package/src/settings.ts

@@ -28,6 +28,8 @@ export interface JevAutoModeSettings {
   readonly extraProtectedPaths: readonly string[];
   /** Shared state + questions budget guard, in characters. */
   readonly maxStateCharacters: number;
+  /** What a middle-band judgment means. Default `deny`: no user confirmation. */
+  readonly uncertain: UncertainAction;
   /**
    * Per-rule probability thresholds, overriding the calibrated defaults.
    *
@@ -39,6 +41,18 @@ export interface JevAutoModeSettings {
 
 export type SettingsScope = "global" | "project";
 
+/**
+ * How a judgment that lands in the middle band is resolved.
+ *
+ * `deny` (the default) means the gate never takes over the screen: Jev's probability
+ * is the whole answer, and "not sure" fails closed like every other undecidable
+ * state. `ask` hands the call to the user, which contradicts the point of an auto
+ * mode and is therefore opt-in. `allow` trusts the middle band.
+ */
+export type UncertainAction = "deny" | "ask" | "allow";
+
+export const UNCERTAIN_ACTIONS: readonly UncertainAction[] = ["deny", "ask", "allow"];
+
 export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   enabled: true,
   timeoutMs: 4000,
@@ -48,6 +62,7 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   disallowedCommands: [],
   extraProtectedPaths: [],
   maxStateCharacters: 120_000,
+  uncertain: "deny",
   thresholds: {},
 };
 
@@ -101,6 +116,10 @@ function readThresholds(value: unknown): Readonly<Record<string, number>> | unde
   return thresholds;
 }
 
+export function isUncertainAction(value: unknown): value is UncertainAction {
+  return typeof value === "string" && UNCERTAIN_ACTIONS.includes(value as UncertainAction);
+}
+
 function readBoundedInteger(value: unknown, min: number, max: number): number | undefined {
   if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
   const rounded = Math.round(value);
@@ -140,6 +159,10 @@ export function parseSettingsPatch(value: unknown): SettingsPatch {
   const maxStateCharacters = readBoundedInteger(record.maxStateCharacters, 1000, 1_000_000);
   if (maxStateCharacters !== undefined) patch.maxStateCharacters = maxStateCharacters;
 
+  if (record.uncertain !== undefined && isUncertainAction(record.uncertain)) {
+    patch.uncertain = record.uncertain;
+  }
+
   const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
   if (safeCommands !== undefined) patch.safeCommands = safeCommands;
 

package/src/ui.ts

@@ -43,9 +43,97 @@ export function describeSettings(settings: JevAutoModeSettings, scope: SettingsS
     `disallowed commands: ${settings.disallowedCommands.length}`,
     `extra protected paths: ${settings.extraProtectedPaths.length}`,
     `max state characters: ${settings.maxStateCharacters}`,
+    `uncertain band: ${settings.uncertain}`,
   ].join("\n");
 }
 
+/**
+ * A bounded rendering of a command, for dialogs.
+ *
+ * Pi's dialogs do not clip their content: a 60-line title fills the pane and pushes
+ * the dialog's own heading off screen, and opening and closing one per tool call
+ * makes the terminal scroll back and forth. So the preview is bounded here, and the
+ * full command stays where it already is — in the tool call above the dialog.
+ */
+export interface CommandPreview {
+  readonly lines: readonly string[];
+  readonly truncated: boolean;
+  readonly hiddenLines: number;
+  readonly hiddenCharacters: number;
+}
+
+export const DEFAULT_PREVIEW_LINES = 6;
+export const DEFAULT_PREVIEW_LINE_LENGTH = 120;
+
+export function previewCommand(
+  command: string,
+  options: { readonly maxLines?: number; readonly maxLineLength?: number } = {},
+): CommandPreview {
+  const maxLines = options.maxLines ?? DEFAULT_PREVIEW_LINES;
+  const maxLineLength = options.maxLineLength ?? DEFAULT_PREVIEW_LINE_LENGTH;
+
+  const all = command.split("\n");
+  const kept = all.slice(0, maxLines);
+  const lines = kept.map((line) => (line.length > maxLineLength ? `${line.slice(0, maxLineLength)}…` : line));
+  const hidden = all.slice(maxLines);
+
+  // A single 4000-character line has no hidden lines, but most of it was still cut.
+  const cutCharacters = kept.reduce((total, line, index) => total + Math.max(0, line.length - (lines[index]?.length ?? 0)), 0);
+  const hiddenCharacters = hidden.reduce((total, line) => total + line.length + 1, 0) + cutCharacters;
+
+  return {
+    lines,
+    truncated: hidden.length > 0 || cutCharacters > 0,
+    hiddenLines: hidden.length,
+    hiddenCharacters,
+  };
+}
+
+/** Cut a text block to a line budget, marking what was dropped. */
+export function clampLines(text: string, maxLines: number): string {
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) return text;
+  return [...lines.slice(0, maxLines - 1), `… (${lines.length - maxLines + 1} more lines)`].join("\n");
+}
+
+export interface ConfirmationParts {
+  readonly tool: string;
+  readonly command?: string;
+  readonly path?: string;
+  readonly reasons: readonly string[];
+  readonly rationale: string;
+}
+
+/** The dialog shown when a judgment is delegated to the user. */
+export const CONFIRMATION_MAX_LINES = 14;
+
+export function buildConfirmationDialog(parts: ConfirmationParts): string {
+  const preview = parts.command === undefined ? undefined : previewCommand(parts.command);
+  const hiddenNote =
+    preview?.truncated === true
+      ? `… ${[
+          preview.hiddenLines > 0 ? `${preview.hiddenLines} more line(s)` : undefined,
+          `${preview.hiddenCharacters} more character(s)`,
+        ]
+          .filter(Boolean)
+          .join(", ")} — the full command is in the tool call above`
+      : undefined;
+
+  return clampLines(
+    [
+      "Jev auto mode wants confirmation before this runs.",
+      `Tool: ${parts.tool}`,
+      ...(preview?.lines ?? []),
+      ...(hiddenNote === undefined ? [] : [hiddenNote]),
+      ...(parts.path === undefined ? [] : [parts.path]),
+      "",
+      `Matched: ${parts.reasons.join(", ")}`,
+      parts.rationale,
+    ].join("\n"),
+    CONFIRMATION_MAX_LINES,
+  );
+}
+
 export const USAGE_TEXT = [
   "Usage:",
   "  /jev-auto-mode                     show status",
@@ -57,6 +145,16 @@ export const USAGE_TEXT = [
   "  /jev-auto-mode threshold           show thresholds and last observed probabilities",
   "  /jev-auto-mode threshold <rule> <0.5-1.0>",
   "  /jev-auto-mode threshold reset [rule]",
+  "  /jev-auto-mode threshold edit      pick a rule and type a value",
+  "  /jev-auto-mode uncertain            show what the middle band resolves to",
+  "  /jev-auto-mode uncertain deny|ask|allow",
+].join("\n");
+
+export const UNCERTAIN_EXPLANATION = [
+  "The middle band is where Jev is neither satisfied nor rejecting.",
+  "  deny  - block it. No prompt, no screen takeover: Jev's probability is the answer.",
+  "  ask   - hand the call to the user. Opt-in, because it hands the decision back to a human.",
+  "  allow - let it through. Trusts the band; the least safe of the three.",
 ].join("\n");
 
 export const POLICY_HEADER = [
@@ -97,7 +195,7 @@ export function formatRuleTable(
   overrides: Readonly<Record<string, number>> = {},
   observed: ReadonlyMap<string, ObservedCondition> = new Map(),
 ): string {
-  const header = `${pad("rule", 24)}${pad("mode", 10)}${pad("severity", 10)}${pad("threshold", 30)}last observed`;
+  const header = `${pad("rule", 28)}${pad("mode", 10)}${pad("severity", 10)}${pad("threshold", 30)}last observed`;
   const rows = rules.map((rule) => {
     const override = overrides[rule.id];
     const threshold = override ?? rule.threshold;
@@ -105,7 +203,7 @@ export function formatRuleTable(
     // Recompute against the effective rule, not the default one: the point of the
     // last-observed column is to answer "what would this answer mean now".
     const effective = override === undefined ? rule : { ...rule, threshold: override };
-    return `${pad(rule.id, 24)}${pad(rule.mode, 10)}${pad(rule.severity, 10)}${pad(`${formatThreshold(threshold)} ${origin}`, 30)}${describeLast(effective, observed.get(rule.id))}`;
+    return `${pad(rule.id, 28)}${pad(rule.mode, 10)}${pad(rule.severity, 10)}${pad(`${formatThreshold(threshold)} ${origin}`, 30)}${describeLast(effective, observed.get(rule.id))}`;
   });
 
   const unknown = Object.keys(overrides).filter((ruleId) => !rules.some((rule) => rule.id === ruleId));