v0.3.1

0.3.1 — 2026-09-18

• Jev calls retry on 429/5xx and network errors inside one time budget (JEV_GUARD_TIMEOUT_MS, 20 s), so a hook never outlives its host's ~30 s timeout and fail-closed actually fails closed.
• Instruction-file scans share one content-hash cache across the session-start sweep, InstructionsLoaded, Read/Skill results and scan-skills; cache hits carry only Jev's answer and the verdict is rebuilt.
• An answer with no kind is treated as serious instead of crashing the message builder; JEV_GUARD_SKILL_P / JEV_GUARD_SKILL_SERIOUS_P documented.

v0.3.0

0.3.0 — 2026-09-18

• Context: every decision now sees the user's recent prompts, the agent's stated intent, recent decisions and flagged content (src/context.js, src/session.js). Two new questions: user_requested (turns ask into allow when the user asked for exactly that) and from_untrusted (denies a call that carries out an instruction planted in something the agent read). Prompt hooks on every host feed the memory; pi, OpenCode and ACP read the session directly.
• Instruction files: skills, plugins, rules and CLAUDE.md/AGENTS.md are checked with their own questions (INSTRUCTION_QUESTIONS) at session start, on InstructionsLoaded, when a Skill runs, when the agent reads one, and via jev-guard scan-skills; results cached by content hash.
• Third-party skill/plugin/MCP installs count as level-2 (ask) actions.
• OpenCode: expose main and exports["./server"], which is what OpenCode's npm plugin loader resolves; "plugin": ["jev-guard"] now works from the registry.
• check / scan exit 3 with a one-line error instead of a stack trace when Jev is unreachable.

v0.2.1

0.2.1 — 2026-09-18

• OpenCode: expose main and exports["./server"], which is what OpenCode's npm plugin loader resolves; "plugin": ["jev-guard"] now works from the registry.
• check / scan exit 3 with a one-line error instead of a stack trace when Jev is unreachable.