v0.7.2

Patch release for piped-input handling on Windows and the safety hook's handling of firewall 403s.

• Piped stdin works on Windows. triage, find, diff, and progress now read st.mode's stat type bits directly instead of trusting isFIFO()/isSocket(), which libuv does not set for a shell pipe on Windows. Previously piped input was silently treated as "none" — triage errored out and diff/progress fell back to the working tree. cat build.log | jev-axi triage and the README's npm test 2>&1 | jev-axi triage now work.
• A firewall HTML 403 no longer blocks the safety hook. When an edge in front of the API (not the API itself) answers with an HTML 403, the request never reached the model, so it is now reported as unavailability and fails open under --on-error auto, like other network errors. A JSON 403 from the API that names the key or rule still denies by default.

Fixes #33 and #34 via #35

v0.7.1

Patch release for the PreToolUse safety hook and guard-exec.

• Reword safety question examples that the TypeSafe API firewall rejected, restoring Jev judgments for ordinary checked calls.
• Deny a tool call by default when its safety request receives HTTP 403. Other API errors retain the normal fallback, and --on-error can override the default.
• Update the documentation and add regression tests for API rejection behavior.

A fresh 44-case safety evaluation made all expected decisions: 42 were judged locally or by Jev, and two exfiltration requests were denied after the API firewall rejected them. Those two remain unscored by Jev.

Full changes: #31

v0.7.0

A third git hook. pre-commit and commit-msg judge one commit at a time; pre-push judges everything a push would send, as one range, which is where a different class of problem shows up.

This is also the release where three claims in our own documentation were corrected against the data already in the repository. Details below, because a benchmark number that nobody can reproduce is worse than no number.

New

• jev-axi hook pre-push, installed by jev-axi setup git-hooks alongside the other two. Four questions about the pushed range:
  • a schema, migration, or data-format change with no rollback, deploy, or ordering note anywhere in the commit subjects or the diff
  • a range touching authentication, authorization, permission checks, cryptography, session and token handling, or credential storage
  • hand-edited files a build normally produces: bundled output, compiled assets, vendored directories, generated clients. Lockfiles are excluded
  • work-in-progress leftovers that got past pre-commit because they were added in an earlier commit
• The range is git's, not a guess. The hook reads the ref updates git passes on stdin, so it judges exactly remote..local. Deletions are skipped. For a branch no remote has seen, it judges the commits no remote has yet, and a root commit falls back to diffing against the empty tree.
• Each range is reported once. Pushing a branch repeatedly while you work would otherwise repeat an identical warning until you stop reading it. The warned range is recorded in stats/push-seen.json, keyed by repository, remote ref, and local sha; new commits change the key and warn again. Entries older than 30 days are dropped.
• By hand: --range a..b for a range, --file <patch> for a patch, and --json reports all four probabilities rather than only the raised ones. The plain output stays one quiet line when nothing is flagged, because a hook that prints four numbers on every push teaches you to ignore it.

What is sent

At most 20,000 characters of diff with credentials redacted, plus the commit subjects and the file list with line counts. Ranges over 60 files or 50 commits are skipped rather than truncated. No key, no network, a git error, or an unparseable range all skip quietly: a hook that fails a push because the API was down would be worse than no hook. Warn-only unless --block-on flags, which fails the push only on a concern at or above 0.8.

bench/cases/push.yaml holds six labeled cases, one per concern plus two that must stay quiet, so flagging everything fails as surely as flagging nothing. pnpm eval --only push scored 6/6 with a mean of 0.97 on the current model.

Corrected

Three numbers in the docs were not supported by the data in this repository:

• "agents told to use files read 25% fewer files but cost the same." That was one session's median (16 to 12) quoted without the later session, where the same condition went 14 to 18, and it was attributed to the wrong condition besides. Mean and median disagree in sign within a single session. Six runs per condition cannot call a direction, which bench/agent/README.md already said.
• "at most $0.016 per run" of Jev spend in the agent benchmark. Recomputed from bench/agent/results/*/runs.jsonl, the true maximum is $0.0393; totals are $0.195 of Jev against $36.85 of Claude across 56 runs.
• "44 labeled tool calls (18 harmful)." bench/cases/safety.yaml carries no harmful/benign label; cases record an expected decision, splitting 24 that must be blocked or escalated and 20 that must be allowed. The suite scores 44/44, verified live.

A result we had never written down is now recorded: across the 22 benchmark runs where the agent could choose, it loaded the skill zero times. A SessionStart hook announcing the tool changed nothing, and a custom subagent lost to Claude Code's built-in Explore.

Changed

• The README opens with the safety hook and three transcripts captured from real runs, rather than an explanation of the project's name, and carries a generated demo GIF. scripts/demo/ regenerates it from a committed script and asciinema cast.
• New writeup, docs/skills-do-not-get-used.md, covering what the 56 benchmark runs showed and what they did not.
• The jev-axi skill's repository-setup reference documents pre-push, including what leaves the machine.

0.6.0

Three fixes found while installing 0.5.0 into a real Next.js repo and driving it from an agent harness, plus a notice when a newer jev-axi is published.

New

• Update notice. The bare jev-axi status screen and jev-axi config say when a newer release is on npm. They look it up at most once a day (1s timeout, failures silent); no other command contacts the registry, and command results, --json output, hooks and the Action never show the notice. AUTH_REQUIRED, API_ERROR and UNKNOWN errors repeat it from the saved result, since an upgrade may already fix them. The wording tells agents to mention the update to the user, not to install it. Turn it off with jev-axi config set updateCheck false or NO_UPDATE_NOTIFIER=1; it is always off when CI is set.
• possible-secret flag in diff, the pre-commit hook and the Action. See the second fix below.

Fixed

• diff no longer hangs when stdin is open but idle (#16). Several agent harnesses hold a child's stdin open without writing or closing it, and the read waited for an EOF that never came. Pipes and sockets are now read with a deadline: diff and progress wait one second for a first byte before falling back to the working tree; commands whose only input is stdin wait up to ten minutes, so npm test 2>&1 | jev-axi triage still works. If your producer is slow to start, git diff | jev-axi diff - waits for it.
• Credentials matched only by the generic patterns are now reported (#17). Auth headers, scheme://user:pass@ URLs and PASSWORD= / TOKEN= / *_KEY= values were redacted before sending but never flagged, so nothing judged them. They now raise possible-secret and a review verdict. block still belongs to the specific formats (private keys, vendor tokens, JWTs). Types, function calls, env references and placeholders are ignored. Redaction markers now name what was removed, e.g. [REDACTED URL PASSWORD].
• The API key is found in .env.local and from subdirectories (#18). Discovery walks from the working directory up to the git root, reading .env.local before .env at each level. AUTH_REQUIRED lists everywhere it looked, and jev-axi config shows which file the key came from.
• A file is no longer labelled (truncated) just because redaction shortened its patch.

Changed

• The jev-axi skill tells the agent to repeat where the key was looked for instead of stating that none exists, and to report an available update rather than act on it.

v0.5.0

Supervision: a fast model watches an agent's session and says when the job isn't done, or when the agent is stuck. The idea comes from thruwire/foreman, which runs Jev as a supervisor above a coding agent; jev-axi does the same job through the agent's own hooks instead of owning the loop.

Jev only scores. A short ordered policy picks the verdict: a person is needed (escalate), stuck or off track (steer), then continue, verify, finish.

New

• jev-axi progress --job "<task>". Scores the diff, and recent test output when you pipe it in or pass --log, against the task: implementation complete, tests sufficient, requirements satisfied, needs verification. --events <json> adds the worker questions. Exits 3 unless the verdict is finish, so scripts can gate on it.
• jev-axi setup supervise [--project] [--agent claude|codex] [--block] [--remove]. Two hooks for Claude Code or Codex:
  • Stop: when a turn ends and the repository changed during the session, it scores the job against the diff. Silent on finish, on mid-range scores, when nothing changed, and on any error. Warn-only unless --block, which sends the agent back at most once per stop.
  • PostToolUse: keeps the last 30 tool calls locally and every 10 scores stuck, off track, or blocked on a person. Adds a note to the agent's context; never blocks.
• jev-axi stats gains a supervise section: verdict counts per hook, and the last five times a hook spoke. Read it before turning on --block.

What is sent

At most 20,000 characters of diff, 12,000 of output and 30 events, with credentials redacted. Credential files (.env, *.pem, .npmrc, id_rsa, ...) are never sent, tracked or not, and work that was already uncommitted when the session began is left out. This is more than the safety hook sends.

Changed

• The jev-axi skill covers progress, how to treat a supervision note, and a workflow for checking a long job before calling it done. When asked to "set up jev-axi here" it now asks which integrations you want instead of installing a default set.
• The adopting-jev skill points at the live docs (docs.typesafe.ai/llms.txt, and .md on any page path) as the source of truth over its own numbers, and gains guidance on what confidence measures, self-standing score levels, candidate coverage for extraction, stated premises for speculative questions, keeping raw judgments so policy changes need no re-run, inferred versus observed state, and sorting a failure by cause.

Calibration

These scores are not calibrated for any particular project, which is why warn-only is the default and --block is opt-in. bench/cases/progress.yaml holds 8 labeled cases. The hooks read the job from the agent's transcript, a format neither Claude Code nor Codex guarantees; when it can't be read they do nothing. Tool calls the agent was denied never reach the PostToolUse hook, so they don't count toward the stuck check.

v0.4.3

Scoring fix for large inputs, including our first outside contribution.

CLI

• find, rank and files no longer hide strong hits in large inputs. When a file or item set spans several model calls, each score was divided by the sum over all calls, so p shrank as the input grew and good hits fell below --min: a 0.63 line in a 26,000-line file showed as 0.08 and find --min 0.5 returned nothing. p is now the chunk's existence probability times the line or item's probability within it. It means the same thing at any input size and is the number --min compares against.
• In multi-call runs the shown p values are therefore larger than before and no longer sum to 1 across the whole input. Ordering is unchanged, and single-call output is identical.

Thanks to @2001Y for finding the find bug and fixing it with a careful regression test in #10; #11 extends the fix to rank and files.

v0.4.2

Skills only; the CLI is unchanged apart from one flag.

Skills

• New adopting-jev skill: finds where TypeSafe's Jev model fits in a codebase and designs the integration. It scans for LLM calls that only classify or score, keyword rules over free text, moderation and reranking calls, LLM-as-judge harnesses, and manual triage queues; qualifies each against Jev's real limits; designs the questions; picks an integration point; and plans a validation against what you run today. Its references carry a use-case catalog compiled from the TypeSafe docs, cookbooks, workflow evals, and around 30 community projects, including the cases where Jev measurably loses.
• jev-axi skill restructured: SKILL.md is now a short router. The detail moved into references: step-by-step workflows, reading results, and a new guide to adding jev-axi to a repository (safety hook, guard-exec, git hooks, the GitHub Action, shared recipes, agent helpers), including what each sends to TypeSafe and how to remove it.
• Both descriptions rewritten to lead with the use case and name the triggers, following the skills guidance.

npx skills add shiftynick/jev-axi --skill jev-axi --agent claude-code
npx skills add shiftynick/jev-axi --skill adopting-jev --agent claude-code

CLI

• jev-axi recipe new --project creates a recipe in ./.jev-axi/recipes/ to commit and share with a team.

v0.4.1

Improved

• Sharper triage. jev-axi triage now picks the line with the specific error message (the assertion, exception, or compiler error) over lines that only name the failing test or count failures. On real vitest CI logs, the likely cause moved from the per-file summary line at p≈0.35 to the assertion at p≈0.9. All triage evals improved or held, including five new cases taken from real GitHub Actions failures.
• GitHub Action: one entry per root cause. Triage comments show a root cause shared by several matrix jobs once, listing the jobs, instead of repeating it for each job.

v0.4.0

New

• GitHub Action. uses: shiftynick/jev-axi@v0, set up from the examples in the README.
  • Review mode: comments on each pull request with per-file risk and flags, updating the same comment on later runs. It fails the check when a file appears to add a credential.
  • Triage mode: explains failed CI jobs from a workflow_run event or from a log file.
  • It needs no checkout and skips quietly on pull requests from forks, which get no secrets.
• jev-axi guard-exec -- <command>. Runs the agent safety check on a shell command, then runs it, for cron jobs, CI steps, and runbooks.
  • The command's exit code passes through; a blocked command exits 126.
  • When the check wants approval, it asks on a terminal and blocks when there's no terminal.
• jev-axi setup git-hooks.
  • pre-commit: blocks commits that add credentials, found on your machine without sending anything. It then warns about risky files, debug leftovers, and missing tests.
  • commit-msg: warns when the message doesn't describe the diff.
  • Both hooks skip quietly without a key or network.

Changed

• diff and triage redact credentials before sending, and diff flags known credential formats itself.
• diff no longer reports needs-test for a file whose matching test file is in the same diff.
• Commands that print nothing no longer print a blank line. A --help after -- is passed to the wrapped command.

v0.3.0

New

• Safety hook. jev-axi setup safety [--project] [--agent claude|codex] installs a PreToolUse hook that checks risky Bash commands and edits outside the project before they run. Routine calls are decided locally. Other calls go to Jev with secrets redacted, and the contents of local scripts are included. The hook blocks strong destructive, exfiltration, download-and-run, or security-weakening signals, and asks you about moderate ones. It never auto-approves. On 44 labeled calls it blocked all 18 harmful ones and allowed all routine ones.
• Explorer subagent. jev-axi setup agent [--project] [--replace-explore] installs a Claude Code subagent that shortlists files with jev-axi before reading them.
• jev-axi hook pre-tool-use with --explain for testing calls by hand.

Faster

• Chunked commands (batch, find, diff, files) send requests concurrently (JEV_AXI_CONCURRENCY, default 4).
• files shortlists by path before ranking with previews, and includes the repo's docs/. On a large repo it went from 24 calls and 490k Jev tokens to 9 calls and 87k.

Fixed

• Safety edit checks handle Windows path separators.

Benchmark

Real Claude Code sessions on broad exploration tasks showed no cost savings from jev-axi (see bench/agent/README.md). The docs now position jev-axi around judgments and safety.