User repository on GitHub
Pre-install security gate for npm lifecycle scripts using TypeSafe System One.
- Forks
- 0
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.Homepage
CommunityJev Tools & CLIs
Pkg Gate
A pre-install gate for npm lifecycle scripts: pkgGate() pulls the preinstall, install and postinstall hooks from a package name, a path or a raw command, judges them with System One, and returns allow, warn or block.
- Stars
- 0
- Language
- JavaScript
- License
- MIT
- Published by
- Community
- Author
- hemanth
- Last verified
- Oct 2026
About this project
Pre-install security gate for npm lifecycle scripts using TypeSafe System One. pkgGate() evaluates a package or script against TypeSafe System One. report.isSafe() returns a boolean verdict. report.inspect() renders the TUI card. Without TYPESAFEAPIKEY, it falls back to an offline calibrated simulator. Pass a file path or directory. pkgGate extracts preinstall, install, and postinstall hooks and evaluates each in parallel.
Quoted from the project's README. Read the full README.
Works forJev for Classification
Used inJev for Software & DevTools
- Languages
- JavaScript
Highlights
- Accepts a package name, a file or directory, or a raw shell string with { script: true }, and evaluates each lifecycle hook in parallel.
- report.structured gives typed probability distributions and scores without string parsing, and the whole report serializes with JSON.stringify.
- Confidence gates execution: below 0.50 the call routes to human review instead of guessing, and assertSafe() throws with the reasons.
- CLI exit codes are 0 allow, 1 block and 2 warn, with --json and --plain output plus an interactive confirmation prompt on warn.
Watch out
Every judgment is a hosted System One call, so gating a package costs a request per lifecycle script and needs a key in the environment. Without one the library falls back to an offline calibrated simulator, which keeps demos and CI working but returns fixture verdicts rather than assessments — worth knowing before treating a local run as a real result. The gate produces a verdict and typed probabilities, not enforcement: nothing stops npm from running a blocked script unless your own code branches on report.action, and low confidence is routed to review rather than treated as safe. The README documents the API surface, CLI flags and exit codes but not how the threat scores are calibrated. Copy reviewed against the repository README on 2026-10-04, not from running it.
Questions about this entry
Short answers drawn from the linked project or page.
Only what you wire up. pkgGate returns an action of allow, warn or block, and the enforcement is your code: branch on report.action, call assertSafe() to throw with the reasons, and let the CLI's exit codes do it for you, with 0 for allow, 1 for block and 2 for warn. Nothing intercepts npm by itself, and in an interactive terminal a warning prompts you to confirm.
It falls back to an offline calibrated simulator rather than failing, which is convenient for demos and CI but means the verdict is not a real judgment in that mode. With a TYPESAFE_API_KEY set, pkgGate evaluates a package or script against TypeSafe System One, extracts the preinstall, install and postinstall hooks when given a path or directory, and evaluates each hook in parallel.
The structured output is the part worth integrating: instead of parsing strings you get typed probability distributions and scores, such as an intent choice like credential_access and a probability for secret access. Confidence also gates the decision — anything below 0.50 routes to human review rather than a guess, and warn exists precisely so a middling verdict is not silently treated as safe. The caveat is that the README sets no out calibration data for the threat scores.
Yes, and that is the clearest use of the raw-script mode. Pass a command string with { script: true } to evaluate it as a script, which the README shows blocking a curl-piped-to-bash one-liner, and the CLI takes the same input as a quoted argument. That lets you screen a command you are about to run without installing anything first.
The preinstall, install, and postinstall hooks, extracted when you hand it a package name, a path, or a directory, and each hook is evaluated in parallel. The report also serializes cleanly with JSON.stringify, and the CLI offers --json and --plain output plus an interactive confirmation prompt when the verdict is warn, with exit codes 0 for allow, 1 for block, and 2 for warn.
TYPESAFE_API_KEY in the environment is what switches it from the offline calibrated simulator to real System One calls. Without one you still get a verdict and typed probabilities, but they are fixture responses, not assessments, which is why the offline mode is fine for demos and CI and misleading as evidence.
report.structured gives you typed probability distributions and scores with no string parsing, such as an intent choice like credential_access alongside a probability for secret access, and the whole report serializes with JSON.stringify. That is the part worth integrating: you can gate on numbers rather than scrape verdict strings out of prose.
More Jev resources like this
46GitHub stars
Browser app for systematic-review extraction that opens a trial report with supplements and returns verbatim quotes with file and place, stored locally as projects holding studies.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
choxos/jev-reviewerJavaScript
choxos/jev-reviewerJavaScript23GitHub stars
Self-hosted Google Apps Script that classifies Gmail by meaning with Jev Choice over your own dozen-label taxonomy, checking metadata first and full content only when confidence demands it.
Jev Tools & CLIs#community#jevbest#catalog-import
2GitHub stars
Chrome extension that labels Bluesky posts and drafts with tone classifiers as you read or type, hiding results the model is not confident about.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
sriganesh/jevibe-checkJavaScript
sriganesh/jevibe-checkJavaScript3GitHub stars
Classifies an artist's discography by theme, mood and lyrical complexity with Jev, then renders it as an Ink terminal dashboard. MusicBrainz supplies the discography, lrclib.net the lyrics, one batched call per track.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
lirantal/discoprintJavaScript
lirantal/discoprintJavaScript38GitHub stars
Python memory filter that judges every stored memory against the current request with one calibrated yes/no per memory in a single Jev request, keeping everything above a threshold.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
samdotmak/jev-recallTypeScript
samdotmak/jev-recallTypeScript39GitHub stars
Video tool where Jev scores subtitle segments and code assembles a short highlights cut plus a de-watered full cut with timestamped summaries.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
cclank/jevclipPython
cclank/jevclipPythonFrom the Jev guides
Original write-ups on what this entry is for.
The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.
Jev Tools & CLIs#gateway#vercel#cloudflare
Read article
Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.
Jev Tools & CLIs#open-models#local#onnx
Read article
Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.
Jev Tools & CLIs#classification#email#security
Read article
From the Jev community
Posts from builders shipping with Jev right now.