Question 1

Will this fight with my existing deny and prompt rules?

Accepted Answer

No, by design. deny rules and an approval policy of deny are left untouched, and a prompt rule is left untouched in every mode including yolo, because the native gate already prompts there. A narrow allow rule is also left alone, because an explicit decision about a specific shape is never re-judged. Only blanket allows such as * or **, or a command with no matching rule, get classified. The README also notes the plugin never bypasses the native gate, weakens your rules, or executes anything itself - it blocks, or it asks.

Question 2

What happens when the API is down or the answer comes back malformed?

Accepted Answer

It fails closed, never open. A judgment the gate cannot obtain - no API key, a non-2xx response, an unparseable body, a missing or mistyped answer field, or a timeout - raises a permission request, and in a headless session with no dialog it blocks instead. An unavailable judgment is never cached and never read as a verdict: nothing that cannot be derived from returned numbers counts as SAFE. An unexpected plugin crash also blocks the call, and a dialog fired by a session whose on-disk plugin changed says so in the subtitle.

Question 3

If I click Allow for session, can an edited command slip through on that grant?

Accepted Answer

The grant is keyed to keep flags as split, sorted short bundles plus the first argument, so rewordings of a simple action still match, while compounds and command substitutions fall back to an exact-text key and an edited segment or payload cannot ride the grant. Grants are capped at 50 per session, die with the session or a classifier config change, and answering with one also lifts any refusal recorded for that action in that directory. They still sit below critical patterns, caller-supplied env and your static rules.

Question 4

Does it add a Jev call to every single bash command I run?

Accepted Answer

Not to every one. Critical-pattern matches prompt with no Jev call at all, and anything decided by a deny, prompt or narrow allow rule never reaches the model. Blanket allows and unmatched commands are classified in every mode, and for eval, payloads that only compute, parse, format or read locally pass with zero cost - only payloads containing subprocess entry points are classified, judged by what the spawned command would do.

Question 5

What happens to commands longer than 8,000 characters?

Accepted Answer

They are blocked outright, because nothing that long can be reviewed in full. Separately, even a SAFE verdict auto-runs only when the command avoids the forced-dialog set, so certain destructive shapes such as recursive rm on a glob still prompt before running.

Question 6

What does the four-choice permission prompt offer?

Accepted Answer

Allow once, Allow for session, Always allow and Deny, showing the full command, the gate's reason and only the details that differ from their defaults. Canceling or timing out counts as Deny. Critical-pattern and env-override prompts show only Allow once and Deny.

Question 7

How long do the session and persistent grants last?

Accepted Answer

A session grant covers this action in this exact directory for the rest of the session, up to 50 per session, and dies with the session or a classifier config change. Always allow writes a persistent grant for the exact command text and directory for 30 days, capped at 500 entries and toggleable with persistentGrants: false.

Omp Jevens Classifier

About this project

Highlights

Questions about this entry

More Jev resources like this

From the Jev community