Jev Sentinel

On Pi it acts as the gate because Pi has no permission system. On Claude Code and Codex it adds a content-aware layer over host prompts, with output checks wired after the tool and ask mapped to the host approval prompt.

Jev answers intent and risk in one request and code applies thresholds in order: high risk or injected share warns with Block highlighted, mid risk or off-task asks, high on-task runs, and anything else asks. Long inputs and post-injection states always ask.

Export TYPESAFE_API_KEY, then use pi install for Pi or the marketplace plugin commands for Claude Code and Codex. Plugins run from TypeScript source and need Node 22.18 or newer on PATH.

If Jev says more context would help, the extension adds earlier messages, fuller outputs, or file contents and asks again for up to three rounds. If Jev errors or no key is set, it fails closed and asks you.

Pattern-based, and the README says it reduces leaks rather than guaranteeing none. Output from .env, key, and credential files is withheld by name for the whole session even after compaction, and values of environment variables whose names contain KEY, TOKEN, SECRET, PASSW, CREDENTIAL, or AUTH are scrubbed, as are NAME=value lines with those names and Bearer tokens, from everything sent to Jev. A bare token in an ordinary file is not detected, and values shorter than 8 characters are left alone.

AGENTS.md, CLAUDE.md, and .pi/ by default, configurable through trustedPaths. Paths are relative to the project root, so AGENTS.md means only the root one while **/AGENTS.md means any, and nothing outside the project is trusted. A trusted file skips the output check but not the tool-call check, which is how a README that asks for curl piped to sh still gets caught.

Yes, there is a sandbox set for exactly that: four practice projects with planted traps including a poisoned README, an injection buried 1,487 characters into a file, fake .env secrets, and a login bug to pin against. Each comes with PowerShell scripts to start pi, read the decision log, and reset. The test suite is 106 unit tests with a fake Jev, plus npm run live-check for scripted scenarios against the real API in all three question modes.