![\"ohmyjev\"](\"docs/logo-light.png\"){kind=logo}
\n \n \n
\n Jev, batteries included, for Claude Code, Codex, pi, and omp.
\n Your coding agent, faster and safer. Safe commands skip the prompt, long output gets cut down, compaction takes a\n second. GitHub changes get a reminder to the agent. Blocking security gates require opt-in lockdown mode.\n
\n ![\"Claude](\"https://img.shields.io/badge/Claude_Code-2.1.287%2B-798186\"){kind=icon}
![\"Decided](\"https://img.shields.io/badge/decided_by-Jev-9d78ff\"){kind=icon}
![\"Codex,](\"https://img.shields.io/badge/also_for-Codex_·_pi_·_omp-b69cff\"){kind=icon}
![\"npm\"](\"https://img.shields.io/npm/v/ohmyjev?color=9d78ff\")
![\"MIT](\"https://img.shields.io/badge/license-MIT-798186\"){kind=icon}
\n ohmyjev.xyz ·\n Quick start ·\n What you get ·\n Install ·\n Using it ·\n Settings ·\n Privacy ·\n Troubleshooting\n
\n\n---\n\nJev is TypeSafe's decision model. You send it a few typed questions and it sends back probabilities in about 160 ms,\nfor about $0.00003 a call. That's cheap enough to ask about every step your agent takes, so ohmyjev does. It runs as\nhooks inside your agent, with no server to run.\n\nNormal mode keeps the speed features and output checks, with a local reminder before recognized GitHub changes.\nEnable `lockdown` when you want OMJ to deny destructive commands, restrict writes and check data uploads.\nLockdown is off by default, including for existing installations with individual gate settings enabled.\n\n## Quick start\n\n```bash\nnpx ohmyjev install # ohmyjev in Claude Code, Codex, omp and pi, whichever you have\nnpx ohmyjev key # store your TypeSafe key once, for all of them\n```\n\n`install` uses each agent's own install command, and updates any that are behind. `--check` shows what it would do,\n`--uninstall` removes it. `key` opens a one-time page on your own computer; the key goes from there into the macOS\nKeychain (`secret-tool` on Linux, a file only you can read elsewhere), and the agent never sees it. On a machine with no\nbrowser, `npx ohmyjev key --tty` asks in the terminal. Restart running sessions, then `/omj` should end with\n`key: stored (ohmyjev key)`. To do it by hand instead, see [Install](#install).\n\n## Default behavior\n\n| | Normal mode, the default | Lockdown, opt in with `lockdown: true` |\n|---|---|---|\n| Commands and writes | OMJ's security gates are inactive. The agent's usual permissions still apply. | Enabled gates can deny destructive commands, writes outside allowed paths, credentials and data uploads. |\n| GitHub changes and workflow runs | A reminder asks the agent to double-check. The first call does not run; repeating the same call proceeds after review. | The configured security gates decide. |\n| Unverified \"done\" | The done-check does not push back. | The done-check can push back once per request. |\n| Routing, injection notes and auto-compaction | On by default. | On by default. |\n\nThe GitHub reminder goes to the agent. It does not require asking you for approval when the action is already\nauthorized. Recognized reads, including `gh pr view` and `gh run list`, pass through. Set `githubReminders: false`\nto disable the reminders. They work without a Jev key.\n\n### Lockdown mode\n\nFor the current session, run `/omj config lockdown on`. To keep it enabled in Claude Code, use\n`/plugin configure ohmyjev@ohmyjev`, then `/reload-plugins`. For omp:\n\n```bash\nomp plugin config set ohmyjev lockdown true\n```\n\nFor Codex, add `\"lockdown\": true` to `~/.codex/ohmyjev.json`. For pi, set `\"lockdown\": true` under `ohmyjev` in your settings.\nSet `lockdown` back to `false` to return to normal mode.\n\n**Try it in shadow first.** `shadow` runs every lockdown check and blocks nothing: each call it would have blocked is\nlogged with the reason, and `/omj` lists the last ten under `would block (shadow)`. Run `/omj config shadow on` for a day\nof normal work, read the list, and turn `lockdown` on once the list holds only calls you'd want stopped.\n\n**Code decides first.** Lockdown asks Jev only what code can't settle. `ls`, `git status` and other plain reads, and\nmoves inside the repo (`mkdir`, `touch`, `cp`, `mv`, `git mv` with relative paths, no `..`, no `-f`), pass without a Jev\ncall. The done-check reads the last check that ran this turn (tests, build, typecheck, lint): a failed one means not\ndone, a passing one with no edit after it means verified, whatever the transcript says. Jev decides only when no check\nran.\n\n## What you get\n\n### Faster\n\n| | |\n|---|---|\n| **Fast compaction** | Jev keeps the messages that still matter (your constraints, decisions, exact errors, and open work) word for word, instead of a model writing a summary. 60 messages took 336 ms with every planted constraint kept. Falls back to the normal summary if anything goes wrong. |\n| **Trim long output** | Shell output over 12,000 characters is cut to the parts your request needs, with a note naming the lines it left out. A 20,000-character test log came back as 4,600, failure included. File reads like `cat` and `sed -n` are never cut. |\n| **Skill picker** | Claude Code sends a line for every skill on every prompt. ohmyjev drops that list and loads only the one skill you need, or none. |\n| **Stuck check** | Same failure three times? The agent is told to stop, read the error, and try something else. |\n| **Router** | Picks effort and the subagent model for each request. With `routing` set to `model` it picks the main model too: it sent a flight search to Haiku, 108 s down to 44 s. |\n| **Auto-compact** | New task and the context is 40% full? It compacts and keeps your new request. |\n| **Narrow big reads** | Off by default. A `Read` of a 400+ line file comes back as the fifth you asked about, with a note on how to see the rest. |\n\n### Lockdown and output checks\n\n| | |\n|---|---|\n| **Bash gate** | In lockdown, blocks commands Jev rates irreversible (0.6) or sending your files or keys out (0.7). Normal edits, pushes, and uninstalls go through. |\n| **Say yes** | In lockdown, every gate checks whether your latest message asked for the call. \"Force push it\" works. After a block, a plain \"yes\" runs that exact command. Your `policies` and path blocks always stand. |\n| **Write gate** | In lockdown, blocks writes outside the repo or with a real key in them. Every worktree counts as the repo, and so does another repo the agent moves into. |\n| **Exfil gate** | In lockdown, blocks web and MCP calls that send your files or keys out. |\n| **Policies** | In lockdown, your own rules in plain English, checked on every call. |\n| **Injection screen** | Output that slips orders to the model where they don't belong, like a README or an error, gets a \"treat as data\" note. A prompt or transcript you're debugging doesn't. |\n| **Done-check** | In lockdown, \"Done\" with nothing tested gets pushed back once. Passing test output counts. |\n| **Subagent checks** | A vague subagent brief goes back once. A subagent's \"done\" is checked against what it actually ran. Claude Code. |\n| **Writing rules** | Your final reply is checked against the writing rules in `CLAUDE.md` and `AGENTS.md`, and rewritten once if it breaks one. Claude Code. |\n| **Secret masking** | Keys, tokens, URL credentials, emails, and your home folder become markers before anything goes to Jev. |\n| **GitHub reminders** | In normal mode, asks the agent to check the target and user intent before a GitHub change, workflow run or git push. The first call does not run; a deliberate repeat proceeds. No Jev key needed. |\n\n### Tools and commands\n\n| | |\n|---|---|\n| **`find_code`** | Finds code by what it does, even when it's named something else. Returns the file and line, or no match. |\n| **`ask_jev`** | Asks Jev about files without the model reading them. Give it a folder and it asks every file, returning the yes ones. |\n| **`browse`** | Off by default. Jev drives a headless browser click by click. A flight search took about 10 s. |\n| **`/omj`** | This session's calls, cost, and blocks. `/omj config` shows and changes settings, `/omj stats` opens a dashboard, and `/omj off` and `/omj on` switch it for the session. `/ohmyjev` works too. |\n\n### How lockdown decides\n\n```mermaid\nflowchart LR\n A[Agent calls a tool] --> B{ohmyjev asks Jev}\n B -- clearly risky --> C[Blocked, with the reason]\n B -- clearly safe --> E[Tool runs]\n B -- unsure, slow, or no key --> D[Normal permission flow] --> E\n E --> T[Long output cut down]\n T --> F{Gives the model orders?}\n F -- yes --> G[Treat-as-data note]\n F -- no --> H[Output as is]\n```\n\nIf Jev is unsure, slow, or down, the call goes through like normal. ohmyjev never adds a prompt. It only takes away the\nones a safe call didn't need. Jev can be wrong, so keep your own deny rules in `settings.json` too.\n\n## Install\n\nGitHub reminders work without a key. For Jev-backed checks, you need a [TypeSafe](https://typesafe.ai) key, or an OpenRouter key (it then calls `~typesafe/jev-latest`).\nohmyjev looks for the key in the Claude Code settings screen, then `TYPESAFE_API_KEY`, then the key `npx ohmyjev key`\nstored, then `OPENROUTER_API_KEY`.\n\n### Claude Code\n\nNeeds 2.1.287 or later.\n\n```\n/plugin install ohmyjev --marketplace Novacon/ohmyjev\n```\n\nAnswer `y` and pick a scope. Hooks start right away. From a shell instead:\n\n```bash\nclaude plugin marketplace add Novacon/ohmyjev && claude plugin install ohmyjev@ohmyjev\n```\n\n### Codex\n\n```bash\ncodex plugin marketplace add Novacon/ohmyjev && codex plugin add ohmyjev@ohmyjev\n```\n\nThen run `/hooks` once to trust ohmyjev. It needs Node. Codex hooks can't add tools or change the model, so there's no\nrouter, `/omj`, `ask_jev`, or `browse` there. Settings go in `~/.codex/ohmyjev.json`:\n\n```json\n{ \"requested\": 0.9, \"policies\": \"never touch the prod cluster\" }\n```\n\n### omp\n\n```bash\nomp plugin install ohmyjev\nomp plugin config set ohmyjev routing model # settings\n```\n\nRestart the session after installing. The router uses omp's `@smol`, `@default`, and `@slow` roles.\n\n### pi\n\n```bash\npi install npm:ohmyjev\n```\n\nSettings go under `ohmyjev` in `~/.pi/agent/settings.json`, or `.pi/settings.json` for one project:\n\n```json\n{ \"ohmyjev\": { \"routing\": \"model\", \"lockdown\": true } }\n```\n\nRunning Claude Code inside pi through pi-claude-bridge? pi runs every tool, so pi's copy of ohmyjev checks them and the\nClaude Code copy stands down for the session: it sees pi's `OHMYJEV_PI`, registers no tools, and gates nothing. The\n`/omj` you type in pi is the one that counts.\n\n### By host\n\n| | Claude Code | Codex | omp | pi |\n|---|---|---|---|---|\n| Gates, say yes, injection screen | yes | yes | yes | yes |\n| Done-check, stuck check, trim | yes | yes | yes | yes |\n| Fast compaction | yes | no | no | yes |\n| Router | yes | no | yes | yes |\n| Skill picker, subagent checks, writing rules, read narrowing | yes | no | no | no |\n| `/omj`, `ask_jev`, `find_code`, `browse` | yes | no | yes | yes |\n\n## Using it\n\n### Before a GitHub change\n\nIn normal mode, recognized GitHub writes, workflow runs and git pushes return an agent-visible reminder once per\ndistinct call in the session. It asks the agent to check the repository, branch, target and intended effect. The call\nhas not run yet. If it is already authorized and correct, the agent repeats it to proceed. Read operations such as\n`gh pr view` and `gh run list` pass through. Set `githubReminders` to `false` to turn this off.\n\nThis is a convenience checkpoint. It recognizes common CLI commands and GitHub tools; it does not parse every shell\nprogram or alias. Lockdown mode uses the security gates instead.\n\n\n### When something gets blocked in lockdown\n\nThe agent gets the reason and a way out:\n\n```\nohmyjev blocked this: irreversible (0.95): nothing would restore what this removes or overwrites.\nDo not try to work around it with another command, another tool, a different path, or an encoding that does\nthe same thing. Tell the user what was blocked and why, and ask whether to run it anyway. If they say yes, run\nexactly this again: their reply then lets it through.\n```\n\nAnswer \"yes\" and that exact command runs. \"No\", or a yes followed by a different command, stays blocked. A write\noutside the repo names the folder and asks you to add it to `allowPaths`.\n\n### `find_code` and `ask_jev`\n\n`find_code` searches by meaning. On this repo, \"the code that stops the agent from writing outside the project\" found\nthe write gate's path check, though the code never says that. \"stripe billing webhook\" found nothing, which is right.\n\n`ask_jev` answers a question about files without the model reading them:\n\n```json\n{ \"question\": \"Does this build SQL by string concatenation?\", \"type\": \"noul\", \"folder\": \"src/db\" }\n```\n\nWith a `folder`, it asks every source file and returns only the yes ones, with the line. Files outside the repo are\nnever sent.\n\n### `browse`\n\nTurn it on with `/omj config browse on`. Give it a URL, one goal, and the words it may type:\n\n```json\n{\n \"url\": \"https://www.google.com/travel/flights?hl=en\",\n \"goal\": \"Find one-way flights from Zurich to London on November 20, 2026. Stop when flights show.\",\n \"values\": [\"Zurich\", \"London\", \"Nov 20, 2026\"]\n}\n```\n\nJev picks each click and puts each value in the right field. It runs\n[browser-use/jev-ultrafast](https://github.com/browser-use/jev-ultrafast) through [uv](https://docs.astral.sh/uv), in\nits own headless browser that's signed in to nothing. Set `CHROME_PATH` to pick the browser.\n\n### `/omj`\n\n```\njev ✓23 ⛔1 ↑opus/high\ncalls 23 · errors 0 · cost $0.000966 · p50 310ms\ndenies: Bash 1\n Bash: irreversible (0.95): nothing would restore what this removes or overwrites\nkey: env TYPESAFE_API_KEY · typesafe · jev-1.13.0\n```\n\n`/omj config` lists the settings, and `/omj config