ohmyjev

Jev is TypeSafe's decision model. You send it a few typed questions and it sends back probabilities in about 160 ms, for about $0.00003 a call. That's cheap enough to ask about every step your agent takes, so ohmyjev does. It runs as hooks inside your agent, with no server to run.

Normal mode keeps the speed features and output checks, with a local reminder before recognized GitHub changes. Enable lockdown when you want OMJ to deny destructive commands, restrict writes and check data uploads. Lockdown is off by default, including for existing installations with individual gate settings enabled.

Quick start

export TYPESAFE_API_KEY=ts_...     # in your shell profile

Then in Claude Code:

/plugin install ohmyjev --marketplace Novacon/ohmyjev
/omj

If /omj ends with key: env TYPESAFE_API_KEY, you're set. Codex, pi, and omp are under Install.

Default behavior

The GitHub reminder goes to the agent. It does not require asking you for approval when the action is already authorized. Recognized reads, including gh pr view and gh run list, pass through. Set githubReminders: false to disable the reminders. They work without a Jev key.

Lockdown mode

For the current session, run /omj config lockdown on. To keep it enabled in Claude Code, use /plugin configure ohmyjev@ohmyjev, then /reload-plugins. For omp:

omp plugin config set ohmyjev lockdown true

For Codex, add "lockdown": true to ~/.codex/ohmyjev.json. For pi, set "lockdown": true under ohmyjev in your settings. Set lockdown back to false to return to normal mode.

What you get

Faster

Lockdown and output checks

Tools and commands

How lockdown decides

flowchart LR
    A[Agent calls a tool] --> B{ohmyjev asks Jev}
    B -- clearly risky --> C[Blocked, with the reason]
    B -- clearly safe --> E[Tool runs]
    B -- unsure, slow, or no key --> D[Normal permission flow] --> E
    E --> T[Long output cut down]
    T --> F{Gives the model orders?}
    F -- yes --> G[Treat-as-data note]
    F -- no --> H[Output as is]

If Jev is unsure, slow, or down, the call goes through like normal. ohmyjev never adds a prompt. It only takes away the ones a safe call didn't need. Jev can be wrong, so keep your own deny rules in settings.json too.

Install

GitHub reminders work without a key. For Jev-backed checks, you need a TypeSafe key, or an OpenRouter key (it then calls ~typesafe/jev-latest). ohmyjev looks for the key in the Claude Code settings screen, then TYPESAFE_API_KEY, then OPENROUTER_API_KEY.

Claude Code

Needs 2.1.287 or later.

/plugin install ohmyjev --marketplace Novacon/ohmyjev

Answer y and pick a scope. Hooks start right away. From a shell instead:

claude plugin marketplace add Novacon/ohmyjev && claude plugin install ohmyjev@ohmyjev

Codex

codex plugin marketplace add Novacon/ohmyjev && codex plugin add ohmyjev@ohmyjev

Then run /hooks once to trust ohmyjev. It needs Node. Codex hooks can't add tools or change the model, so there's no router, /omj, ask_jev, or browse there. Settings go in ~/.codex/ohmyjev.json:

{ "requested": 0.9, "policies": "never touch the prod cluster" }

omp

omp plugin install ohmyjev
omp plugin config set ohmyjev routing model     # settings

Restart the session after installing. The router uses omp's @smol, @default, and @slow roles.

pi

pi install npm:ohmyjev

Settings go under ohmyjev in ~/.pi/agent/settings.json, or .pi/settings.json for one project:

{ "ohmyjev": { "routing": "model", "lockdown": true } }

Running Claude Code inside pi through pi-claude-bridge? pi runs every tool, so pi's copy of ohmyjev checks them and the Claude Code copy stands down for the session: it sees pi's OHMYJEV_PI, registers no tools, and gates nothing. The /omj you type in pi is the one that counts.

By host

Using it

Before a GitHub change

In normal mode, recognized GitHub writes, workflow runs and git pushes return an agent-visible reminder once per distinct call in the session. It asks the agent to check the repository, branch, target and intended effect. The call has not run yet. If it is already authorized and correct, the agent repeats it to proceed. Read operations such as gh pr view and gh run list pass through. Set githubReminders to false to turn this off.

This is a convenience checkpoint. It recognizes common CLI commands and GitHub tools; it does not parse every shell program or alias. Lockdown mode uses the security gates instead.

When something gets blocked in lockdown

The agent gets the reason and a way out:

ohmyjev blocked this: irreversible (0.95): nothing would restore what this removes or overwrites.
Do not try to work around it with another command, another tool, a different path, or an encoding that does
the same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run
exactly this again: their reply then lets it through.

Answer "yes" and that exact command runs. "No", or a yes followed by a different command, stays blocked. A write outside the repo names the folder and asks you to add it to allowPaths.

find_code and ask_jev

find_code searches by meaning. On this repo, "the code that stops the agent from writing outside the project" found the write gate's path check, though the code never says that. "stripe billing webhook" found nothing, which is right.

ask_jev answers a question about files without the model reading them:

{ "question": "Does this build SQL by string concatenation?", "type": "noul", "folder": "src/db" }

With a folder, it asks every source file and returns only the yes ones, with the line. Files outside the repo are never sent.

browse

Turn it on with /omj config browse on. Give it a URL, one goal, and the words it may type:

{
  "url": "https://www.google.com/travel/flights?hl=en",
  "goal": "Find one-way flights from Zurich to London on November 20, 2026. Stop when flights show.",
  "values": ["Zurich", "London", "Nov 20, 2026"]
}

Jev picks each click and puts each value in the right field. It runs browser-use/jev-ultrafast through uv, in its own headless browser that's signed in to nothing. Set CHROME_PATH to pick the browser.

/omj

jev ✓23 ⛔1 ↑opus/high
calls 23 · errors 0 · cost $0.000966 · p50 310ms
denies: Bash 1
  Bash: irreversible (0.95): nothing would restore what this removes or overwrites
key: env TYPESAFE_API_KEY · typesafe · jev-1.13.0

/omj config lists the settings, and /omj config <name> <value> changes one for the session. A * marks a value that differs from the default. /omj stats opens a dashboard of every session at ~/.ohmyjev/dashboard.html. /omj off turns everything off for the session.

Your own rules

In lockdown, put rules in policies, separated by ;, and each enabled gate checks calls against them:

never touch the prod cluster; no deploys on Friday; don't edit migrations that already ran

Status line

jev ✓23 ⛔1 ↑opus/high 🗜2     calls, blocks, this turn's route, compactions
jev ⚠ down                    Jev failed in the last 5 minutes, so calls go through
jev ⚠ no key                  no key found
jev off                       turned off for this session

To put it in your own statusline script, copy jev_segment() from extras/statusline_segment.py. Turn the built-in one off with statusLine.

Settings

/omj config lists the settings, and /omj config <name> <value> changes one for the session. To keep a change, use /plugin configure ohmyjev@ohmyjev then /reload-plugins in Claude Code, omp plugin config set in omp, or each host's settings file. Each setting turns a whole feature on or off; thresholds, models and timeouts are fixed.

Privacy

GitHub reminders run locally and make no Jev calls. With lockdown off, commands and edits are never sent to Jev. Other enabled output and quality checks keep their own settings.

Each check sends Jev only what it needs, cut to size, with secrets masked first. With no key, nothing goes.

Logs stay in ~/.ohmyjev, readable only by you. They hold verdicts, probabilities, latency, and cost, never your commands' output.

Update or remove

claude plugin update ohmyjev@ohmyjev       # then restart; or: claude plugin uninstall ohmyjev@ohmyjev
codex plugin marketplace upgrade ohmyjev   # then trust the changed hooks in /hooks; or: codex plugin remove ohmyjev@ohmyjev
omp plugin upgrade ohmyjev                 # or: omp plugin uninstall ohmyjev
pi update npm:ohmyjev                      # or: pi remove npm:ohmyjev

Troubleshooting

jev ⚠ no key. Set TYPESAFE_API_KEY in the shell that starts your agent, or enter it with /plugin configure ohmyjev@ohmyjev.

GitHub reminder. The call has not run. The agent can check the target and existing authorization, then repeat the same call to proceed. This reminder alone does not require asking you. Set githubReminders off to disable it.

jev ⚠ down. Jev failed or took over 1.5 s in the last 5 minutes. Calls go through until it's back.

Blocked by mistake in lockdown. Say yes and it runs. /omj shows why. /omj config lockdown off or /omj off for the session. Local MCP tools sometimes trip the exfiltration check.

Nothing happens. The first transcript line should start with [ohmyjev]. If not, run claude --debug to see which hook failed.

Develop

git clone https://github.com/Novacon/ohmyjev && cd ohmyjev && bun install
claude --plugin-dir "$PWD"                  # or: omp -e ./adapters/omp.ts, pi -e ./adapters/pi.ts
bun run test && bun run typecheck && claude plugin validate .
bun tests/live.ts                           # 28 real commands against the live Jev
bun tests/live-screen.ts                    # 11 outputs against the injection screen

The decisions live in hooks/policy.ts, plain functions tested with tables. hooks/ohmyjev.ts wires them to Claude Code, and adapters/ to Codex, omp, and pi.

Credits

Question rubrics from disler/ten-levels-of-jev. browse runs browser-use/jev-ultrafast. find_code, folder sweeps, and read narrowing are ported from BorisLeMeec/jev. Fast compaction follows 0x7067/claude-jev, subagent checks austpryb/jev-hooks, the writing-rule check vgeshel/prose-check, and masking tsetse012/jev-hook-guard. All MIT.