pi-jev-auto-mode 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.5.0 - 2026-09-24
+
+- **Decision records are compact by default.** An approval is drawn as one line — status, tool,
+  latency, and the command — and a block as two, keeping the rationale. Each record used to take
+  five padded blocks, so a long session was mostly gate records. `/jev-auto-mode display full`
+  (or `"display": "full"`) restores the previous view, and the expanded view shows every detail
+  in either mode.
+
+## 0.4.1 - 2026-09-18
+
+- **An unclear answer passes by default.** `uncertain` defaulted to `deny`, which meant a
+  judgment the model was unsure about stopped the call. That is the interruption an auto mode
+  exists to remove; clear rejections still block. `uncertain deny` and `uncertain ask` remain
+  available for anyone who wants the stricter behaviour.
+- **Without a key the gate says so and stops**, instead of inventing a verdict and blocking with
+  an unexplained reason. The message names the fix: `/jev-auto-mode login`, or
+  `/jev-auto-mode off`. The footer reads `🛡 jev no key` in that state, and the session start
+  warns once.
+- **A chain of read-only commands is read-only.** `cd src && ls -la && git log -3` was judged as
+  a whole because the allowlist rejected any command containing shell control syntax, so agents
+  paid a judgment round trip for their most common line. Each segment is now checked on its own,
+  and `cd` is allowed. A chain containing anything else (`curl … | sh`) is still judged.
+- **The docs match the no-key behaviour.** The README and a comment still described a fallback
+  that confirms in a UI, which the gate no longer does: without a key it stops the calls it cannot
+  judge and says it is not connected to Jev.
+
 
 ## 0.4.0
 

package/README.md

@@ -113,15 +113,22 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 /jev-auto-mode uncertain                show what the middle band resolves to
 /jev-auto-mode uncertain deny|ask|allow
 /jev-auto-mode scope all|matched        how far the semantic layer reaches
+/jev-auto-mode display full|compact     how decision records are drawn
 ```
 
+Each decision leaves a record in the transcript. `display: "compact"` (the default) folds an
+approval into one line and a block into two (the rationale stays, because a block is something
+to act on). `display: "full"` shows the heading, the engine line, the command, the reasons, and
+the rationale. The expanded view shows every detail in either mode.
+
 ```
 pi --jev-auto-mode        start with auto mode enabled
 ```
 
 The semantic layer needs a [TypeSafe](https://typesafe.ai/) API key. Jev is early access, so an
-account may be waitlisted; **the gate still works without one**, running in ask-only mode
-(confirm in a UI, block without one) rather than silently allowing everything.
+account may be waitlisted; **the gate still works without one**. Its own rules keep running —
+read-only and user-declared safe commands pass, hard-deny shapes are blocked — but a call
+nothing vouches for is blocked with "Not connected to Jev" instead of being judged.
 
 `/jev-auto-mode login` asks for the key, verifies it against the API (`GET /v1/models`), and
 stores it as an owner-only file at
@@ -134,9 +141,9 @@ A key is only stored after the API accepts it: a typo that got saved would turn
 that silently blocks every escalated call. If the API cannot be reached the key is not stored
 either, and the command says so rather than claiming success.
 
-Without a key the gate does not disable itself: it falls back to the ask-only engine, which
-confirms in a UI and blocks when there is none. The footer shows `🛡 jev (<scope>)` while the
-semantic layer is active and `🛡 jev ask-only (<scope>)` when it is not.
+Without a key the gate does not disable itself and does not allow everything: it stops the calls
+it cannot judge and says it is not connected to Jev. The footer shows `🛡 jev (<scope>)` while the
+semantic layer is active and `🛡 jev no key (<scope>)` when it is not.
 
 ## Tuning
 
@@ -194,6 +201,7 @@ Policy notes: `$PI_CODING_AGENT_DIR/jev-auto-mode-policy.md`.
   "maxStateCharacters": 120000,
   "uncertain": "deny",
   "gateScope": "all",
+  "display": "compact",
   "thresholds": {}
 }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",

package/src/decide.ts

@@ -75,9 +75,8 @@ export interface DecisionEngine {
 /**
  * Milestone-1 engine: no semantic judgment at all.
  *
- * Every candidate is reported as `uncertain`, which means "ask the user when a UI
- * exists, block otherwise". That keeps the deterministic layer shippable and
- * verifiable on its own, and it fails in the safe direction.
+ * The gate checks for this engine before judging: with no key there is nothing to
+ * judge with, so it says so and blocks the call instead of inventing a verdict.
  */
 export function createManualEngine(): DecisionEngine {
   return {

package/src/extension.ts

@@ -41,7 +41,7 @@ import {
   dangerousReasons,
   evaluateUserCommandRules,
   hardDenyReasons,
-  isReadOnlyCommand,
+  isReadOnlyCommandChain,
   isUserDeclaredSafeCommand,
   PROTECTED_DIRECTORY_SEGMENTS,
   unique,
@@ -55,6 +55,7 @@ import {
 import {
   DEFAULT_SETTINGS,
   JevAutoModeStore,
+  isDisplayMode,
   isGateScope,
   isUncertainAction,
   parseThreshold,
@@ -64,6 +65,7 @@ import {
 import {
   buildConfirmationDialog,
   describeSettings,
+  DISPLAY_EXPLANATION,
   GATE_SCOPE_EXPLANATION,
   UNCERTAIN_EXPLANATION,
   formatRuleTable,
@@ -80,6 +82,13 @@ export const AUTO_MODE_COMMAND = "jev-auto-mode";
 /** The escalation reason for a call no pattern describes, under `gateScope: "all"`. */
 export const NOT_KNOWN_SAFE_REASON = "not on the known-safe list";
 
+/** The engine used when no semantic layer is available. */
+export const MANUAL_ENGINE_ID = "manual";
+
+/** Shown (and used as the block reason) when the gate has no Jev connection. */
+export const NO_ENGINE_MESSAGE =
+  "Not connected to Jev (no TypeSafe API key is set). Run `/jev-auto-mode login` to set a key, or `/jev-auto-mode off` to stop auto mode.";
+
 /** Structural context: what this extension needs from Pi, and nothing more. */
 export interface GateUi {
   notify(message: string, type?: "info" | "warning" | "error"): void;
@@ -248,7 +257,7 @@ export async function evaluateToolCall(
     const matchedReasons = dangerousReasons(command, ctx.cwd);
     if (matchedReasons.length > 0) {
       reasons = matchedReasons;
-    } else if (isReadOnlyCommand(command)) {
+    } else if (isReadOnlyCommandChain(command)) {
       return undefined;
     } else if (state.settings.gateScope === "matched") {
       return undefined;
@@ -265,6 +274,20 @@ export async function evaluateToolCall(
     reasons = protectedReasons;
   }
 
+  // Without a key there is nothing to judge with. Say so and stop, rather than
+  // letting a call through unjudged or blocking it with an unexplained verdict.
+  if (deps.engine.id === MANUAL_ENGINE_ID) {
+    const rationale = NO_ENGINE_MESSAGE;
+    writeRecord(deps, {
+      call,
+      reasons,
+      status: "blocked",
+      source: "unavailable",
+      rationale,
+    });
+    return { block: true, reason: rationale };
+  }
+
   const input: CandidateInput = {
     call,
     reasons,
@@ -460,8 +483,9 @@ export interface RegisterOptions {
 /**
  * Build the semantic engine for the current settings.
  *
- * Without a key the gate keeps working with the ask-only engine rather than
- * dropping to "allow": the degradation stays visible and stays closed.
+ * With no key the gate still runs its own rules, but a call nothing vouches for is
+ * blocked with "Not connected to Jev" rather than judged. A missing key must not
+ * turn into "allow everything".
  */
 export function createEngine(
   settings: JevAutoModeSettings,
@@ -534,6 +558,9 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
     await rebuildEngine();
     loaded = true;
     updateStatus(ctx, { enabled: state.settings.enabled, engineId: deps.engine.id, scope: state.scope });
+    if (state.settings.enabled && deps.engine.id === MANUAL_ENGINE_ID) {
+      ctx.ui.notify(NO_ENGINE_MESSAGE, "warning");
+    }
   };
 
   const save = async (ctx: GateContext): Promise<void> => {
@@ -546,7 +573,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
     default: false,
   });
 
-  registerDecisionEntryRenderer(pi);
+  registerDecisionEntryRenderer(pi, () => state.settings.display);
 
   pi.registerCommand(AUTO_MODE_COMMAND, {
     description: "Show or change the Jev auto mode settings",
@@ -554,7 +581,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
       const value = String(argumentPrefix ?? "");
       const tokens = value.split(/\s+/).filter(Boolean);
       if (tokens.length === 0) {
-        return ["status", "on", "off", "policy", "threshold", "scope", "uncertain", "login", "logout"].map((item) => ({
+        return ["status", "on", "off", "policy", "threshold", "scope", "uncertain", "display", "login", "logout"].map((item) => ({
           value: item,
           label: item,
         }));
@@ -685,7 +712,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
           "Remove the stored TypeSafe API key?",
           availability.source === "env"
             ? "It is not in use anyway: TYPESAFE_API_KEY takes precedence."
-            : "The semantic layer will fall back to ask-only until a key is available again.",
+            : "Without a key the gate blocks every call it cannot vouch for, and says why.",
         );
         if (!confirmed) return;
 
@@ -699,7 +726,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         ctx.ui.notify(
           availability.available
             ? `Stored key removed. Still using ${describeKeySource(availability.source)}.`
-            : "Stored key removed. The semantic layer is now ask-only.",
+            : "Stored key removed. The gate will block calls it cannot vouch for until a key is set again.",
           "info",
         );
         return;
@@ -731,6 +758,23 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         return;
       }
 
+      if (value.startsWith("display")) {
+        const argument = value.slice("display".length).trim();
+        if (argument === "") {
+          ctx.ui.notify(`display: ${state.settings.display}\n\n${DISPLAY_EXPLANATION}`, "info");
+          return;
+        }
+        if (!isDisplayMode(argument)) {
+          ctx.ui.notify(`Expected one of full, compact.\n\n${DISPLAY_EXPLANATION}`, "error");
+          return;
+        }
+
+        state.settings = { ...state.settings, display: argument };
+        await save(gateContext);
+        ctx.ui.notify(`decision records now display as: ${argument}`, "info");
+        return;
+      }
+
       if (value.startsWith("uncertain")) {
         const argument = value.slice("uncertain".length).trim();
         if (argument === "") {

package/src/jev/availability.ts

@@ -1,10 +1,12 @@
 /**
  * Is the semantic layer usable right now, and where did the key come from?
  *
- * A missing key must not silently degrade into "allow everything": the engine
- * falls back to the ask-only engine, which confirms in a UI and blocks without
- * one. The reason and the key's origin are surfaced in `/jev-auto-mode status` so
- * the degradation and the credential path are visible rather than mysterious.
+ * A missing key must not silently degrade into "allow everything". The gate keeps
+ * running its own rules — read-only and user-declared safe commands pass, hard-deny
+ * patterns are blocked — but a call nothing vouches for is blocked with "Not
+ * connected to Jev" instead of being judged. The reason and the key's origin are
+ * surfaced in `/jev-auto-mode status` so the situation is visible rather than
+ * mysterious.
  *
  * `TYPESAFE_API_KEY` wins over the stored secret, so a one-off or CI override does
  * not require touching the stored credential.

package/src/policy.ts

@@ -45,6 +45,7 @@ export interface CommandPattern {
 export const SAFE_COMMANDS: readonly string[] = [
   // Shell state and navigation
   "pwd",
+  "cd*",
   "ls*",
   "tree*",
   "whoami",
@@ -392,6 +393,24 @@ export function isReadOnlyCommand(command: string): boolean {
   return matchesAnyCommandPattern(command, SAFE_COMMANDS, false) !== undefined;
 }
 
+/**
+ * A chain of read-only commands, such as `cd src && ls -la && git log`.
+ *
+ * Agents chain commands constantly, and a single `&&` would otherwise take an
+ * otherwise harmless line out of the fast path and into a judgment round trip.
+ * Every segment must be read-only on its own; `curl … | sh` splits into `curl …`
+ * (not on the list) and `sh` (not on the list), so it is still judged, and a
+ * segment containing a redirection fails the matcher anyway.
+ */
+export function isReadOnlyCommandChain(command: string): boolean {
+  const segments = command
+    .split(/&&|\|\||;|\||\n/)
+    .map((segment) => segment.trim())
+    .filter((segment) => segment.length > 0);
+  if (segments.length === 0) return false;
+  return segments.every((segment) => isReadOnlyCommand(segment));
+}
+
 /**
  * Patterns the user declared safe.
  *

package/src/records.ts

@@ -6,10 +6,11 @@
  * recorded rationale should not become ammunition for the next tool call.
  */
 
-import { Box, Text } from "@earendil-works/pi-tui";
+import { Box, Text, truncateToWidth, type Component } from "@earendil-works/pi-tui";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { ConditionReport, DecisionSource } from "./decide.ts";
 import { formatThreshold } from "./jev/decide.ts";
+import type { DisplayMode } from "./settings.ts";
 
 export const DECISION_ENTRY_TYPE = "jev-auto-mode-decision";
 
@@ -85,12 +86,77 @@ export function formatConditionLines(record: DecisionRecord): string[] {
   });
 }
 
-export function registerDecisionEntryRenderer(pi: Pick<ExtensionAPI, "registerEntryRenderer">): void {
+/** Collapse whitespace so a multi-line command reads as one line. */
+function oneLine(text: string): string {
+  return text.replace(/\s+/g, " ").trim();
+}
+
+export interface CompactDecisionLines {
+  /** `🛡 jev allowed · bash · 299ms · <command>`: everything an approval needs. */
+  readonly headline: string;
+  /**
+   * The rationale, only for a call that did not run. An approval does not need its
+   * reasoning on screen; a block does, because the user has to act on it.
+   */
+  readonly detail?: string;
+}
+
+/**
+ * The compact view: one line for an approval, two for a block.
+ *
+ * Width is applied at render time. This only decides what the lines say.
+ */
+export function formatCompactLines(record: DecisionRecord): CompactDecisionLines {
+  const approved = record.status === "allowed" || record.status === "confirmed";
+  const parts = [`${approved ? "🛡" : "⛔"} jev ${STATUS_LABEL[record.status]}`, record.tool];
+  if (!approved) parts.push(`via ${record.source}`);
+  if (typeof record.latencyMs === "number") parts.push(`${Math.round(record.latencyMs)}ms`);
+  const summary = oneLine(record.summary);
+  if (summary.length > 0) parts.push(summary);
+  const headline = parts.join(" · ");
+  if (approved) return { headline };
+  return { headline, detail: oneLine(record.rationale) };
+}
+
+/** A single line clipped to the viewport instead of wrapped. */
+class ClippedLine implements Component {
+  private readonly text: string;
+
+  constructor(text: string) {
+    this.text = text;
+  }
+
+  render(width: number): string[] {
+    return [truncateToWidth(this.text, Math.max(1, width))];
+  }
+
+  invalidate(): void {}
+}
+
+export type DisplayModeSource = () => DisplayMode;
+
+export function registerDecisionEntryRenderer(
+  pi: Pick<ExtensionAPI, "registerEntryRenderer">,
+  displayMode: DisplayModeSource = () => "compact",
+): void {
   pi.registerEntryRenderer<DecisionRecord>(DECISION_ENTRY_TYPE, (entry, options, theme) => {
     const record = entry.data;
     if (!record) return undefined;
 
     const approved = record.status === "allowed" || record.status === "confirmed";
+
+    // The expanded view is the place to read a decision in full, so it ignores the
+    // compact setting.
+    if (displayMode() === "compact" && !options.expanded) {
+      const lines = formatCompactLines(record);
+      const box = new Box(1, 0, (text) => theme.bg("customMessageBg", text));
+      box.addChild(new ClippedLine(theme.fg(approved ? "muted" : "error", lines.headline)));
+      if (lines.detail !== undefined) {
+        box.addChild(new ClippedLine(theme.fg("dim", `rationale: ${lines.detail}`)));
+      }
+      return box;
+    }
+
     const icon = approved ? "🛡" : "⛔";
     const heading = `${icon} ${theme.bold("jev auto mode")} ${theme.fg(
       approved ? "success" : "error",

package/src/settings.ts

@@ -28,7 +28,7 @@ export interface JevAutoModeSettings {
   readonly extraProtectedPaths: readonly string[];
   /** Shared state + questions budget guard, in characters. */
   readonly maxStateCharacters: number;
-  /** What a middle-band judgment means. Default `deny`: no user confirmation. */
+  /** What a middle-band judgment means. Default `allow`: no user confirmation. */
   readonly uncertain: UncertainAction;
   /**
    * Which calls reach the semantic layer.
@@ -45,6 +45,23 @@ export interface JevAutoModeSettings {
    * visible in `/jev-auto-mode threshold` instead of silently resetting the rule.
    */
   readonly thresholds: Readonly<Record<string, number>>;
+  /**
+   * How decision records are drawn in the transcript.
+   *
+   * `compact` (the default) folds an approval into one line and a block into two, so
+   * a long session is not dominated by gate records. `full` shows the heading, the
+   * engine line, the command, the reasons, and the rationale. The expanded view (the tool
+   * expansion key) always shows every detail, whichever mode is set.
+   */
+  readonly display: DisplayMode;
+}
+
+export type DisplayMode = "full" | "compact";
+
+export const DISPLAY_MODES: readonly DisplayMode[] = ["full", "compact"];
+
+export function isDisplayMode(value: unknown): value is DisplayMode {
+  return typeof value === "string" && DISPLAY_MODES.includes(value as DisplayMode);
 }
 
 export type SettingsScope = "global" | "project";
@@ -52,10 +69,11 @@ export type SettingsScope = "global" | "project";
 /**
  * How a judgment that lands in the middle band is resolved.
  *
- * `deny` (the default) means the gate never takes over the screen: Jev's probability
- * is the whole answer, and "not sure" fails closed like every other undecidable
- * state. `ask` hands the call to the user, which contradicts the point of an auto
- * mode and is therefore opt-in. `allow` trusts the middle band.
+ * `allow` (the default) keeps an auto mode useful: Jev blocks what it can clearly
+ * reject and lets an unclear answer through, so the gate never interrupts. `deny`
+ * is the conservative alternative for anyone who wants "not sure" to stop a call.
+ * `ask` hands the call to the user, which contradicts the point of an auto mode and
+ * is therefore not the default.
  */
 export type UncertainAction = "deny" | "ask" | "allow";
 
@@ -86,9 +104,10 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   disallowedCommands: [],
   extraProtectedPaths: [],
   maxStateCharacters: 120_000,
-  uncertain: "deny",
+  uncertain: "allow",
   gateScope: "all",
   thresholds: {},
+  display: "compact",
 };
 
 const MAX_PATTERN_ENTRIES = 200;
@@ -192,6 +211,10 @@ export function parseSettingsPatch(value: unknown): SettingsPatch {
     patch.gateScope = record.gateScope;
   }
 
+  if (record.display !== undefined && isDisplayMode(record.display)) {
+    patch.display = record.display;
+  }
+
   const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
   if (safeCommands !== undefined) patch.safeCommands = safeCommands;
 

package/src/ui.ts

@@ -21,8 +21,7 @@ export interface StatusInput {
 export function statusText(input: StatusInput): string {
   if (!input.enabled) return "🛡 jev off";
   const scope = input.scope === "project" ? "project" : "global";
-  const engine = input.engineId === "manual" ? " ask-only" : "";
-  return `🛡 jev${engine} (${scope})`;
+  return input.engineId === "manual" ? `🛡 jev no key (${scope})` : `🛡 jev (${scope})`;
 }
 
 export interface StatusContext {
@@ -45,6 +44,7 @@ export function describeSettings(settings: JevAutoModeSettings, scope: SettingsS
     `max state characters: ${settings.maxStateCharacters}`,
     `uncertain band: ${settings.uncertain}`,
     `gate scope: ${settings.gateScope}`,
+    `display: ${settings.display}`,
   ].join("\n");
 }
 
@@ -150,6 +150,15 @@ export const USAGE_TEXT = [
   "  /jev-auto-mode uncertain            show what the middle band resolves to",
   "  /jev-auto-mode uncertain deny|ask|allow",
   "  /jev-auto-mode scope all|matched    which calls reach Jev",
+  "  /jev-auto-mode display full|compact how decision records are drawn",
+].join("\n");
+
+export const DISPLAY_EXPLANATION = [
+  "How decision records are drawn in the transcript.",
+  "  compact - one line for an approval, two for a block (with the rationale) (default).",
+  "  full    - heading, engine line, command, reasons, and rationale.",
+  "The expanded view always shows every detail. New records use the mode at once;",
+  "records already on screen switch when Pi redraws them (e.g. toggling expansion).",
 ].join("\n");
 
 export const GATE_SCOPE_EXPLANATION = [