pi-jev-auto-mode 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.4.1 - 2026-09-18
+
+- **An unclear answer passes by default.** `uncertain` defaulted to `deny`, which meant a
+  judgment the model was unsure about stopped the call. That is the interruption an auto mode
+  exists to remove; clear rejections still block. `uncertain deny` and `uncertain ask` remain
+  available for anyone who wants the stricter behaviour.
+- **Without a key the gate says so and stops**, instead of inventing a verdict and blocking with
+  an unexplained reason. The message names the fix: `/jev-auto-mode login`, or
+  `/jev-auto-mode off`. The footer reads `🛡 jev no key` in that state, and the session start
+  warns once.
+- **A chain of read-only commands is read-only.** `cd src && ls -la && git log -3` was judged as
+  a whole because the allowlist rejected any command containing shell control syntax, so agents
+  paid a judgment round trip for their most common line. Each segment is now checked on its own,
+  and `cd` is allowed. A chain containing anything else (`curl … | sh`) is still judged.
+- **The docs match the no-key behaviour.** The README and a comment still described a fallback
+  that confirms in a UI, which the gate no longer does: without a key it stops the calls it cannot
+  judge and says it is not connected to Jev.
+
 
 ## 0.4.0
 

package/README.md

@@ -120,8 +120,9 @@ pi --jev-auto-mode        start with auto mode enabled
 ```
 
 The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. Jev is early access, so an
-account may be waitlisted; **the gate still works without one**, running in ask-only mode
-(confirm in a UI, block without one) rather than silently allowing everything.
+account may be waitlisted; **the gate still works without one**. Its own rules keep running —
+read-only and user-declared safe commands pass, hard-deny shapes are blocked — but a call
+nothing vouches for is blocked with "Not connected to Jev" instead of being judged.
 
 `/jev-auto-mode login` asks for the key, verifies it against the API (`GET /v1/models`), and
 stores it as an owner-only file at
@@ -134,9 +135,9 @@ A key is only stored after the API accepts it: a typo that got saved would turn
 that silently blocks every escalated call. If the API cannot be reached the key is not stored
 either, and the command says so rather than claiming success.
 
-Without a key the gate does not disable itself: it falls back to the ask-only engine, which
-confirms in a UI and blocks when there is none. The footer shows `🛡 jev (<scope>)` while the
-semantic layer is active and `🛡 jev ask-only (<scope>)` when it is not.
+Without a key the gate does not disable itself and does not allow everything: it stops the calls
+it cannot judge and says it is not connected to Jev. The footer shows `🛡 jev (<scope>)` while the
+semantic layer is active and `🛡 jev no key (<scope>)` when it is not.
 
 ## Tuning
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",

package/src/decide.ts

@@ -75,9 +75,8 @@ export interface DecisionEngine {
 /**
  * Milestone-1 engine: no semantic judgment at all.
  *
- * Every candidate is reported as `uncertain`, which means "ask the user when a UI
- * exists, block otherwise". That keeps the deterministic layer shippable and
- * verifiable on its own, and it fails in the safe direction.
+ * The gate checks for this engine before judging: with no key there is nothing to
+ * judge with, so it says so and blocks the call instead of inventing a verdict.
  */
 export function createManualEngine(): DecisionEngine {
   return {

package/src/extension.ts

@@ -41,7 +41,7 @@ import {
   dangerousReasons,
   evaluateUserCommandRules,
   hardDenyReasons,
-  isReadOnlyCommand,
+  isReadOnlyCommandChain,
   isUserDeclaredSafeCommand,
   PROTECTED_DIRECTORY_SEGMENTS,
   unique,
@@ -80,6 +80,13 @@ export const AUTO_MODE_COMMAND = "jev-auto-mode";
 /** The escalation reason for a call no pattern describes, under `gateScope: "all"`. */
 export const NOT_KNOWN_SAFE_REASON = "not on the known-safe list";
 
+/** The engine used when no semantic layer is available. */
+export const MANUAL_ENGINE_ID = "manual";
+
+/** Shown (and used as the block reason) when the gate has no Jev connection. */
+export const NO_ENGINE_MESSAGE =
+  "Not connected to Jev (no TypeSafe API key is set). Run `/jev-auto-mode login` to set a key, or `/jev-auto-mode off` to stop auto mode.";
+
 /** Structural context: what this extension needs from Pi, and nothing more. */
 export interface GateUi {
   notify(message: string, type?: "info" | "warning" | "error"): void;
@@ -248,7 +255,7 @@ export async function evaluateToolCall(
     const matchedReasons = dangerousReasons(command, ctx.cwd);
     if (matchedReasons.length > 0) {
       reasons = matchedReasons;
-    } else if (isReadOnlyCommand(command)) {
+    } else if (isReadOnlyCommandChain(command)) {
       return undefined;
     } else if (state.settings.gateScope === "matched") {
       return undefined;
@@ -265,6 +272,20 @@ export async function evaluateToolCall(
     reasons = protectedReasons;
   }
 
+  // Without a key there is nothing to judge with. Say so and stop, rather than
+  // letting a call through unjudged or blocking it with an unexplained verdict.
+  if (deps.engine.id === MANUAL_ENGINE_ID) {
+    const rationale = NO_ENGINE_MESSAGE;
+    writeRecord(deps, {
+      call,
+      reasons,
+      status: "blocked",
+      source: "unavailable",
+      rationale,
+    });
+    return { block: true, reason: rationale };
+  }
+
   const input: CandidateInput = {
     call,
     reasons,
@@ -460,8 +481,9 @@ export interface RegisterOptions {
 /**
  * Build the semantic engine for the current settings.
  *
- * Without a key the gate keeps working with the ask-only engine rather than
- * dropping to "allow": the degradation stays visible and stays closed.
+ * With no key the gate still runs its own rules, but a call nothing vouches for is
+ * blocked with "Not connected to Jev" rather than judged. A missing key must not
+ * turn into "allow everything".
  */
 export function createEngine(
   settings: JevAutoModeSettings,
@@ -534,6 +556,9 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
     await rebuildEngine();
     loaded = true;
     updateStatus(ctx, { enabled: state.settings.enabled, engineId: deps.engine.id, scope: state.scope });
+    if (state.settings.enabled && deps.engine.id === MANUAL_ENGINE_ID) {
+      ctx.ui.notify(NO_ENGINE_MESSAGE, "warning");
+    }
   };
 
   const save = async (ctx: GateContext): Promise<void> => {
@@ -685,7 +710,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
           "Remove the stored TypeSafe API key?",
           availability.source === "env"
             ? "It is not in use anyway: TYPESAFE_API_KEY takes precedence."
-            : "The semantic layer will fall back to ask-only until a key is available again.",
+            : "Without a key the gate blocks every call it cannot vouch for, and says why.",
         );
         if (!confirmed) return;
 
@@ -699,7 +724,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         ctx.ui.notify(
           availability.available
             ? `Stored key removed. Still using ${describeKeySource(availability.source)}.`
-            : "Stored key removed. The semantic layer is now ask-only.",
+            : "Stored key removed. The gate will block calls it cannot vouch for until a key is set again.",
           "info",
         );
         return;

package/src/jev/availability.ts

@@ -1,10 +1,12 @@
 /**
  * Is the semantic layer usable right now, and where did the key come from?
  *
- * A missing key must not silently degrade into "allow everything": the engine
- * falls back to the ask-only engine, which confirms in a UI and blocks without
- * one. The reason and the key's origin are surfaced in `/jev-auto-mode status` so
- * the degradation and the credential path are visible rather than mysterious.
+ * A missing key must not silently degrade into "allow everything". The gate keeps
+ * running its own rules — read-only and user-declared safe commands pass, hard-deny
+ * patterns are blocked — but a call nothing vouches for is blocked with "Not
+ * connected to Jev" instead of being judged. The reason and the key's origin are
+ * surfaced in `/jev-auto-mode status` so the situation is visible rather than
+ * mysterious.
  *
  * `TYPESAFE_API_KEY` wins over the stored secret, so a one-off or CI override does
  * not require touching the stored credential.

package/src/policy.ts

@@ -45,6 +45,7 @@ export interface CommandPattern {
 export const SAFE_COMMANDS: readonly string[] = [
   // Shell state and navigation
   "pwd",
+  "cd*",
   "ls*",
   "tree*",
   "whoami",
@@ -392,6 +393,24 @@ export function isReadOnlyCommand(command: string): boolean {
   return matchesAnyCommandPattern(command, SAFE_COMMANDS, false) !== undefined;
 }
 
+/**
+ * A chain of read-only commands, such as `cd src && ls -la && git log`.
+ *
+ * Agents chain commands constantly, and a single `&&` would otherwise take an
+ * otherwise harmless line out of the fast path and into a judgment round trip.
+ * Every segment must be read-only on its own; `curl … | sh` splits into `curl …`
+ * (not on the list) and `sh` (not on the list), so it is still judged, and a
+ * segment containing a redirection fails the matcher anyway.
+ */
+export function isReadOnlyCommandChain(command: string): boolean {
+  const segments = command
+    .split(/&&|\|\||;|\||\n/)
+    .map((segment) => segment.trim())
+    .filter((segment) => segment.length > 0);
+  if (segments.length === 0) return false;
+  return segments.every((segment) => isReadOnlyCommand(segment));
+}
+
 /**
  * Patterns the user declared safe.
  *

package/src/settings.ts

@@ -28,7 +28,7 @@ export interface JevAutoModeSettings {
   readonly extraProtectedPaths: readonly string[];
   /** Shared state + questions budget guard, in characters. */
   readonly maxStateCharacters: number;
-  /** What a middle-band judgment means. Default `deny`: no user confirmation. */
+  /** What a middle-band judgment means. Default `allow`: no user confirmation. */
   readonly uncertain: UncertainAction;
   /**
    * Which calls reach the semantic layer.
@@ -52,10 +52,11 @@ export type SettingsScope = "global" | "project";
 /**
  * How a judgment that lands in the middle band is resolved.
  *
- * `deny` (the default) means the gate never takes over the screen: Jev's probability
- * is the whole answer, and "not sure" fails closed like every other undecidable
- * state. `ask` hands the call to the user, which contradicts the point of an auto
- * mode and is therefore opt-in. `allow` trusts the middle band.
+ * `allow` (the default) keeps an auto mode useful: Jev blocks what it can clearly
+ * reject and lets an unclear answer through, so the gate never interrupts. `deny`
+ * is the conservative alternative for anyone who wants "not sure" to stop a call.
+ * `ask` hands the call to the user, which contradicts the point of an auto mode and
+ * is therefore not the default.
  */
 export type UncertainAction = "deny" | "ask" | "allow";
 
@@ -86,7 +87,7 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   disallowedCommands: [],
   extraProtectedPaths: [],
   maxStateCharacters: 120_000,
-  uncertain: "deny",
+  uncertain: "allow",
   gateScope: "all",
   thresholds: {},
 };

package/src/ui.ts

@@ -21,8 +21,7 @@ export interface StatusInput {
 export function statusText(input: StatusInput): string {
   if (!input.enabled) return "🛡 jev off";
   const scope = input.scope === "project" ? "project" : "global";
-  const engine = input.engineId === "manual" ? " ask-only" : "";
-  return `🛡 jev${engine} (${scope})`;
+  return input.engineId === "manual" ? `🛡 jev no key (${scope})` : `🛡 jev (${scope})`;
 }
 
 export interface StatusContext {