jev-guard (OpenCode)

It is an OpenCode 2 plugin that sends every shell command the agent wants to run to TypeSafe's Jev first — both local shell commands and FarHand's farhand_remote_shell commands on a remote host — and asks you before anything Jev flags as risky.

verdict asks whether the command is anything but ordinary work inside the project; host_litter whether it leaves files outside the project; global_install whether it installs software globally; global_config whether it changes global settings; harmful whether it may do damage; and privacy whether it may expose private data like keys, tokens, .env or personal files.

The command asks. If Jev cannot be reached, times out, or no API key is set, the plugin falls back to OpenCode's normal permission prompt — it never silently runs.

No. The guard only ever adds prompts; it never turns a prompt your OpenCode or FarHand settings ask for into an allow. A tool that approves commands one by one, like Crosstalk, keeps seeing every one of them.

Create a jev-guard.jsonc in ~/.config/opencode (applies to every project) or <project>/.opencode (project-local, and it may only make the guard stricter). You can retune a built-in by its threshold, switch one off with false, or add your own with a label, question and threshold; ids use lowercase letters, digits and underscores.

OpenCode 2.0.14's permission prompt has a fixed body and does not show the reason, so a flagged command also puts a one-line note in the transcript, like Jev on devbox: installs software globally (0.97) · sudo apt-get purge -y tmux. A prompt with no such note was asked by your OpenCode or FarHand permission settings, not by Jev.

Yes. It judges local shell commands and FarHand's farhand_remote_shell commands on a remote host, applying the same six questions and thresholds to both.