Auto-Approve Coding Agent Permission Prompts with Jev

const RISKY = [
  /^(\S*['"\\=$]|[-0-9])/,
  /^(sudo|doas|su)\b/,
  /^(bash|sh|zsh|fish|eval|xargs)\b/,
  /^(node|bun|python3?)\s+(-\S+\s+)*(-c|-e|-p|--eval)\b/,
  /^rm\s+(-\S*[rRf]\S*\s+)+/,
  /^git\b.*\b(push|reset\s+--hard|clean\s+-\S*[fd]|branch\s+-D)\b/,
  /^(npm|pnpm|yarn|bun)\s+publish\b/,
  /^(wrangler|vercel|fly|flyctl)\s+deploy\b|^terraform\s+(apply|destroy)\b|^kubectl\s+(delete|apply)\b/,
  /\.env\b|\.ssh\b|\.aws\b|\.npmrc\b|\.netrc\b|credentials/i,
]

function neverAutoApprove(command: string): boolean {
  if (/\$\(|[<>]\(|`|\\\r?\n/.test(command)) return true
  return command
    .split(/\s*(?:&&|\|\||;|\||&|\n|[(){}])\s*/)
    .map(normalizeCommand)
    .some((part) => RISKY.some((pattern) => pattern.test(part)))
}

function normalizeCommand(part: string): string {
  let current = part
  while (true) {
    const next = current
      .trim()
      .replace(/^(if|then|elif|else|fi|while|until|do|done|for|in|case|esac|!)\s+/, "")
      .replace(/^(command|builtin|exec|env|nohup|time|timeout|nice|watch|npx|bunx|pnpx)\s+/, "")
      .replace(/^[A-Za-z_][A-Za-z0-9_]*=[^\s'"\\$]*\s+/, "")
      .replace(/^\\/, "")
      .replace(/^[^\s'"\\$]*\//, "")
    if (next === current) return current
    current = next
  }
}

const JEV_MODEL = "typesafe/jev-1.13"
const APPROVE_AT = 0.9

const QUESTIONS = {
  reversible: {
    type: "noul",
    instructions:
      "Every command in `commands` only reads or changes files inside `project` and can be undone with git or by rerunning it. It does not push, publish, deploy, delete files outside the project, change system settings, or send data to a network service.",
  },
  serves_task: {
    type: "noul",
    instructions: "Running `commands` is a reasonable next step toward `task`.",
  },
} as const

type State = {
  commands: readonly string[]
  project: string
  task?: string
  agent?: string
}

async function jevApproves(state: State): Promise<boolean | undefined> {
  const asked: ReadonlyArray<keyof typeof QUESTIONS> =
    state.task === undefined ? ["reversible"] : ["reversible", "serves_task"]
  const questions = Object.fromEntries(asked.map((key) => [key, QUESTIONS[key]]))
  const res = await fetch("https://openrouter.ai/api/alpha/decisions", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.OPENROUTER_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ model: JEV_MODEL, state, questions }),
    signal: AbortSignal.timeout(8_000),
  }).catch(() => undefined)
  if (res === undefined) return undefined
  if (!res.ok) {
    await res.body?.cancel()
    return undefined
  }
  const body = (await res.json().catch(() => undefined)) as
    | { answers?: Record<string, { type: "noul"; noul: unknown } | undefined> }
    | undefined
  const scores = asked.map((key) => body?.answers?.[key]?.noul)
  if (!scores.every(isProbability)) return undefined
  return scores.every((score) => score >= APPROVE_AT)
}

function isProbability(value: unknown): value is number {
  return typeof value === "number" && value >= 0 && value <= 1
}

// state, shared by all three requests
{ "task": "Fix the failing date parsing test in src/utils/date.test.ts and make the suite pass",
  "project": "/Users/dev/shop-api", "agent": "build" }

// commands: ["bun test src/utils/date.test.ts"]
{ "answers": { "reversible": { "noul": 0.93 }, "serves_task": { "noul": 0.95 } },
  "usage": { "input_tokens": 400, "output_tokens": 40, "cost": 0.0000168 } }

// commands: ["bun add left-pad"]
{ "answers": { "reversible": { "noul": 0.45 }, "serves_task": { "noul": 0.09 } },
  "usage": { "input_tokens": 397, "output_tokens": 40, "cost": 0.000016674 } }

// commands: ["npx wrangler deploy"]
{ "answers": { "reversible": { "noul": 0.04 }, "serves_task": { "noul": 0.07 } },
  "usage": { "input_tokens": 399, "output_tokens": 40, "cost": 0.000016758 } }

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "shell": "ask"
  }
}

import type { Plugin } from "@opencode/plugin"

type Event = Parameters<Parameters<Plugin.Context["permission"]["hook"]>[1]>[0]

export default {
  id: "jev-permissions",
  setup: async (ctx) => {
    await ctx.permission.hook("evaluate", async (event) => {
      if (event.effect !== "ask" || event.action !== "shell") return
      if (event.resources.some(neverAutoApprove)) return
      if ((await jevApproves(await buildState(ctx, event))) === true) {
        event.effect = "allow"
      }
    })
  },
} satisfies Plugin.Plugin

async function buildState(ctx: Plugin.Context, event: Event): Promise<State> {
  const messages = await ctx.session.context({ sessionID: event.sessionID })
  const task = messages
    .filter((message) => message.type === "user")
    .at(-1)?.text.slice(0, 2_000)
  return {
    task,
    project: ctx.location.directory,
    agent: event.agent,
    commands: event.resources,
  }
}

import { text } from "node:stream/consumers"

type PermissionRequest = {
  cwd: string
  tool_name: string
  tool_input: { command?: unknown; description?: unknown }
  turn_id?: unknown
}

const input = JSON.parse(await text(process.stdin)) as PermissionRequest
const command = input.tool_input.command
const description = input.tool_input.description
if (input.tool_name === "Bash" && typeof command === "string" && !neverAutoApprove(command)) {
  const approved = await jevApproves({
    commands: [command],
    project: input.cwd,
    task: typeof description === "string" && input.turn_id === undefined ? description : undefined,
  })
  if (approved === true) {
    console.log(
      JSON.stringify({
        hookSpecificOutput: { hookEventName: "PermissionRequest", decision: { behavior: "allow" } },
      }),
    )
  }
}

{
  "hooks": {
    "PermissionRequest": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bun ./path/to/jev-permission-hook.ts",
            "timeout": 15
          }
        ]
      }
    ]
  }
}

{
  "hooks": {
    "PermissionRequest": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bun ./path/to/jev-permission-hook.ts",
            "statusMessage": "Checking with Jev",
            "timeout": 15
          }
        ]
      }
    ]
  }
}

import { text } from "node:stream/consumers"

type CursorBeforeShellExecution = { command: string; cwd: string; sandbox: boolean }

function isCursorInput(value: unknown): value is CursorBeforeShellExecution {
  return (
    typeof value === "object" &&
    value !== null &&
    typeof (value as { command?: unknown }).command === "string" &&
    typeof (value as { cwd?: unknown }).cwd === "string"
  )
}

const input: unknown = await text(process.stdin)
  .then((raw) => JSON.parse(raw) as unknown)
  .catch(() => undefined)
const approved =
  !isCursorInput(input) || neverAutoApprove(input.command)
    ? false
    : await jevApproves({ commands: [input.command], project: input.cwd })
console.log(JSON.stringify({ permission: approved === true ? "allow" : "ask" }))

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      {
        "command": "bun ./path/to/jev-permission-hook.ts",
        "timeout": 15,
        "failClosed": true
      }
    ]
  }
}