$ cat ~/map/pi-jev.md

pi-jev

Typed probabilistic judgements: a gate screens pi tool calls before they run and an output judge classifies results.

extensions✓ Sep 17

Run pi install npm:@y0usaf/pi-jev; the extension needs a TypeSafe API key — without one it loads, says so once, and stays out of the way — resolved from TYPESAFE_API_KEY, an apiKey entry, or an apiKeyFile path configured in ~/.pi/agent/pi-jev.json

## TL;DR

A pi extension that wraps TypeSafe Jev as a typed decision layer: a gate asks destructive, exfiltration, beyond-scope, and impact questions about bash, write, and edit calls before they run, an output judge flags leaked secrets and classifies failures in bash output, and a jev_ask tool lets the model request typed judgements itself.

## Key points

• $The gate: four questions — is this action destructive, does it send local data or secrets off-machine, does it affect anything beyond what the user asked, and how much damage if the user did not want it — travel in one request of roughly 300 ms, judged against default thresholds of 0.90 destructive, 0.70 exfiltration, 0.85 beyond-scope, and 2.50 impact on a 0-to-3 damage rubric.
• $Shadow mode is the default: a flagged call produces a notification and a footer status; enforce mode asks you to confirm before the call runs; headless runs (print mode and RPC) cannot show a prompt, so enforcement falls back to the same warning unless gate.blockWithoutUI is set.
• $Every error path fails open: a missing key, a timeout, a 429, or a malformed response produces no verdict and the tool call proceeds, with errors reported at most once a minute; identical input is judged once per cacheSeconds, 120 by default.
• $The output judge: two questions per judged bash result — a leak question against a 0.90 threshold appends do-not-repeat-the-value advice and raises a notification, while a six-way failure class appends class-specific advice only when its confidence clears 0.6; judged tools default to bash only, since judging every read would cost one request per file opened.
• $What leaves the machine: each judgement sends the working directory, the tool name, the first 1200 characters of the last user message, and the tool arguments to api.typesafe.ai; any string field longer than 400 characters is cut to its first 400 plus an elision marker, and setting gate.tools to bash keeps file content out of gate requests entirely.
• $Calibration honesty: the thresholds come from smoke-calibration runs the README publishes in full and explicitly calls not a labelled evaluation set — enough to reject obviously wrong thresholds, and the stated reason the gate does not default to enforce.
• $Commands and config: the /jev family shows mode, model, key source, judged tools, and cache size, toggles both judges for the session, switches gate modes without a reload, and prints the last gate verdict or judged output; a project-scoped .pi/pi-jev.json layers over ~/.pi/agent/pi-jev.json with project values winning per key.

## FAQ

## References

• README ↗

Last updated: Sep 17, 2026