$ cat ~/map/pi-quiet-ask.md

pi-quiet-ask

A rule engine wiring Jev judgements into five pi hooks, with JSON packs deciding block, confirm, annotate, steer.

extensions✓ Sep 20

Run pi install git:github.com/HyunjunJeon/pi-quiet-ask (requires pi 0.85 or newer), then set TYPESAFE_API_KEY via the environment, ~/.pi/agent/pi-quiet-ask.json, or a project .env; the optional triage judge works with the ask_user tool from the @eko24ive/pi-ask extension.

## TL;DR

A JSON rule engine that wires TypeSafe Jev into pi: packs attach to hooks across the session lifecycle, the five built-in packs gate destructive commands, flag leaked secrets, tag intent, check honest completion, and catch stuck loops, and everything defaults to shadow mode.

## Key points

• $Five built-in packs, each with its own hook and default action: gate judges tool_call bash/write/edit for destructive, exfiltration, scope, and impact (default shadow; warns); output checks bash tool_result for leaked secrets and failure class (annotates the result); intent tags the task at before_agent_start (tag plus footer); honest_finish asks at agent_end whether claimed work was verified (default shadow; warns naming the check); stuck watches turn_end for the same failure repeating (default shadow; warns naming the command).
• $Two judges sit outside the pack system because their actions are specific: triage answers ask_user questions from context (suggest or auto-answer), and the task graph tracks which workflow phase each turn is in (HUD plus steer); a work-state evidence ledger records files changed and last verifications without calling Jev.
• $Packs are plain JSON in four flavors — the five built-ins, user-level files under ~/.pi/agent/pi-quiet-ask/packs/, project-level files under .pi/pi-quiet-ask/packs/ (trusted projects only), or packs.<name> entries in config. A pack's on names the hook, when is a cheap pre-Jev filter, mode is shadow (default) or enforce, questions are typed noul/choice/score asks, and ordered rules contribute every matching action with allow stopping evaluation; the README's force.json example blocks git history rewrites, and a real git push --force was blocked at 0.97 probability.
• $Rules read like thresholds: a bare question id is its headline value, and/or/not with parentheses and comparisons compose over it, unknown paths compare false, and there is no way to call code from a rule.
• $State is chosen per pack and redacted before it leaves the machine: sources range from the current arguments and recent turns to the evidence ledger, credentials are removed locally, and the removed values appear in the rule scope as redactions.
• $Shadow semantics are explicit: intervening actions (block, confirm, steer, set_thinking, set_tools) are recorded as would-block lines and nothing actually stops, while always-actions (annotate, warn, status, tag) run in both modes; steer is capped by maxPerPrompt, default 1.
• $The agent cooperates too: a bundled quiet-ask skill teaches the pi agent to leave traces the loop can see and ask only closed questions, jev_ask and jev_choose expose Jev to the model as tools, and for Claude Code/Codex the README points at the separate HyunjunJeon/jev-judgment skill.

## FAQ

## References

• README ↗

Last updated: Sep 20, 2026