JEV Shield
Jev scores prompt injection and proposed shell commands before coding-agent hooks allow them.
Added to Jevfast
How it uses Jev
JEV Shield sends submitted text to Jev System One with the fields `content`, `source`, `trust`, and optional `context`. Its request asks for a Choice content role and Noul risk scores. Shield applies local thresholds to those scores and returns a safe, suspicious, or malicious result. For proposed Bash commands, it first handles obvious local allows and blocks; other commands go to Jev with command context. Jev returns a Choice disposition and a Noul irreversible-harm score, which ordinary code maps to ALLOW, ASK, or BLOCK. These responses are examples of the source-defined request shape, not recorded outputs.
What Jev decides
Illustrative Bash action reviewExample answers · not a recorded Jev response · Source ↗
Question 1 · disposition
YOUR APP
INSTRUCTION
Choose whether the guard should allow the proposed command, ask a human, or block it, using the command context and the stated safety criteria.
STATE
An AI coding agent proposes a command. The request state contains command, cwd, git_branch, environment, tool, agent, and description; missing optional values are null. The description is untrusted agent text.
JEV · CHOICE
- allow
- ask
- block
Question 2 · irreversible harm
YOUR APP
INSTRUCTION
Assess whether running the command would likely destroy data, rewrite shared Git history, expose secrets, or execute untrusted remote code.
STATE
An AI coding agent proposes a command. The request state contains command, cwd, git_branch, environment, tool, agent, and description; missing optional values are null. The description is untrusted agent text.
JEV · NOUL
YesNo
App workflow
- Check the command locally
Shield classifies the proposed Bash command first. Clearly routine commands are allowed, and clear destructive commands are blocked without a Jev request.
- Ask Jev about ambiguous commands
For commands that need judgment, Shield sends a redacted command and bounded context such as the working directory, branch, environment, tool, and untrusted agent description.
- Apply the guard policy
Shield maps Jev's disposition and irreversible-harm score to ALLOW, ASK, or BLOCK. It records the decision in the audit log; an unavailable Jev call follows the configured ASK or BLOCK fail mode.
- Enforce the result in Claude Code
The Bash PreToolUse hook returns the permission decision before the command runs. The separate UserPromptSubmit hook scores submitted prompts and blocks anything Jev does not mark safe. Host timeouts and disabled hooks remain enforcement limits; the guard is not an operating-system sandbox.
Why it is interesting
Shield places an enforcement decision outside the coding model. It combines cheap local rules for clear cases with Jev review for ambiguous commands, and turns Jev's typed judgment into an explicit permission result. Its prompt check also shows how application context can change the reading of an otherwise ordinary message without sending the protected secret itself.