Missing service does not silently allow
The README says missing keys and Jev errors ask the user. This differs from fail-open advisors and needs to be reflected in unattended-use expectations.
Inspect the supporting source ↗REPOSITORY ANALYSIS
pi-jev-sentinel
Open-source Pi coding-agent extension that uses Jev to check tool calls before they run, scan files for prompt injection, flag risky replies, and keep secrets out of what it sends.
E2 · source reviewedPublic material or source evidence was reviewed. A fixed-version source review requires checking a pinned revision; this is not a reproduction, performance endorsement, or safety guarantee.
- Stars
- 9
- Forks
- 1
- License
- MIT
- Last commit
- 2026-09-20
What Jev does here
Before each tool call, Jev receives the user's request (or pinned task), the proposed command, the agent's explanation, and recent conversation. It answers a Choice for intent (on task / off task / injected / needs more context) and a Score for risk (safe / needs approval / harmful). Local code turns these into run, ask the user, or warn. If Jev says more context would help, the extension adds it and asks again.
Adds structured choices or scores to the workflow; performance and cost benefits have not been independently verified.
The cited README and guard.ts were checked for approval on service failure and session taint after suspicious output. No Pi session or live adversarial test was run here. These rules add a review layer; they do not replace host-enforced permissions.
What task does this project fit?
Insert a review step around Pi tool calls and track potentially injected tool output.
Material analysed：
From input to action
- Compare the user task with the proposed action using intent and risk questions.
- Apply ordered local rules to run, ask or warn.
- After suspicious output, retain a tainted-session state requiring further approval.
Implementation details that matter
Warning state can outlive one tool result
The default taintOnInjection behavior makes later actions request approval until reset. Evaluating only the current command would miss the session-level effect.
Inspect the supporting source ↗When to choose it
Use it when human interruption is acceptable and the task context can be provided. It is not a permission sandbox, and probabilistic detection cannot remove host-enforced restrictions.
How to inspect it yourself
Inspect default intent_risk thresholds and ordered rule evaluation in guard.ts. Use fake responses at the 0.3/1.3 risk boundaries and verify that an error produces approval, not run.
Limits of this review
- No Pi session or adversarial live test was run here.
- The repository notes long-context reply checks can raise false alarms and are not enabled by default.