iDiagoValeta’s jev-decision-gate lets TypeSafe Jev answer OpenCode permission prompts. A local command filter runs first. Jev then chooses whether a tool request proceeds, stops or returns to the human.

The repository exposes enough implementation detail to inspect where that authority begins and ends.

Keep the human prompt as the error path

The current adapter tries an awaited permission hook, where OpenCode waits for the plugin’s decision. It falls back to permission-request events when that hook is unavailable.

  • Requests already allowed or denied by configuration keep that decision. The gate intervenes when the permission state is ask.
  • Matching catastrophic command patterns are denied locally before a Jev call.
  • The Python layer sends Jev structured task context, tool details and policy, with pattern-based secret redaction.
  • An unknown decision or evaluation error returns ask-human. The normal prompt remains the fallback.

The author calls this “fail-open to ask-human.” Here, failure hands control back to the person; it does not silently authorize execution.

Confidence never vetoes an approval

Jev answers separate questions about the action, safety and risk. The combining function follows the action alone, regardless of its confidence or the other scores.

One repository unit test supplies an allow answer with 0.12 confidence, a 0.05 safety score and a 1.9 risk score for a destructive request. It still allows the action. That fixture passed locally; these are injected test values, not an observed Jev response.

Typed output checks the decision’s shape. Whether approving the command is correct remains a separate evaluation problem. This implementation delegates that judgment directly to Jev.

Check the path that actually runs

The troubleshooting guide reports that opencode run --auto bypasses the gate, including its local command filter. The author recommends the raw session API for headless work that depends on the gate.

The inspected code also returns immediately when a permission already has an allow effect. Installing a plugin alone therefore provides an incomplete picture of what it controls.

The README describes the event-driven path, while the current implementation prefers the awaited hook. Verify the exact OpenCode version and execution path. The documented --auto reproduction was not repeated here.

Treat context as an attack surface

Conversation text and tool contents can carry hostile instructions into the judge’s input. The implementation marks those fields as untrusted data. Its security policy explicitly acknowledges that persuasive prompt injection can still influence Jev.

The local command filter uses pattern matching and documents false positives. Agent multiple-choice questions can also be answered automatically, extending the delegation beyond permission clicks.

Verification: inspected the Python decision path, TypeScript adapter and security documentation; ran 18 Python decision/CLI tests, all passing. TypeScript paths were inspected only. No live Jev/OpenCode integration, performance reproduction or security audit was performed.