leepokai/jev-guard

Review signals: 1 download and execute, 6 known vulnerability.

Reviewed as expected for a test run: resolver address lookups that send no data.

Source contains download and execute; review its purpose. src/guard.js

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 6 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "jev-guard",
        "install",
        "claude"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "jev-guard: written to <guest-path>\nNo API key found yet: run `jev-guard key <key>` (or export JEV_API_KEY / AI_GATEWAY_API_KEY). Until then the guard fails open.",
      "stderr": "",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  },
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "jev-guard",
        "check",
        "Bash",
        "{\"command\":\"rm -rf ~/\"}"
      ],
      "kind": "cli",
      "returncode": 3,
      "stdout": "",
      "stderr": "jev-guard: no credentials: run `jev-guard key <key>` or set JEV_API_KEY / AI_GATEWAY_API_KEY (exit 3)",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• install writes the guard hooks into the agent's user config: Real input produced the expected result: jev-guard: written to

  Source: `install` is idempotent and writes the absolute path of the current `node`

  Input: jev-guard install claude with HOME set to a scratch directory

  Expected: settings.json written under the scratch HOME

  Command: jev-guard install claude

  Observed: jev-guard: written to <guest-path> No API key found yet: run `jev-guard key <key>` (or export JEV_API_KEY / AI_GATEWAY_API_KEY). Until then the guard fails open.

• check exits with a verdict code: needs a Jev API key (TypeSafe, Vercel AI Gateway or OpenRouter); none is available in this guest, so the CLI exits 3 with 'no credentials'

  Source: Assess one tool call; exit 0 allow, 1 ask, 2 deny

  Observed: needs a Jev API key (TypeSafe, Vercel AI Gateway or OpenRouter); none is available in this guest, so the CLI exits 3 with 'no credentials'

Examples

• offline test suite (README Development section): command completed successfully

  Source: README.md Development: npm test

  Input: npm test in a copy of the checkout named jev-guard (the snapshot path 'workspace' makes one install-path test fail)

  Expected: 18 of 18 tests pass

  Command: npm test

  Observed: duration_ms: 3666.697281 type: 'test' ... # Subtest: issues \#1–\#3: .claude/docs routing, sub-agent results scanned, thresholds range-checked ok 17 - issues \#1–\#3: .claude/docs routing, sub-agent results scanned, thresholds range-checked --- duration_ms: 0.423151 type: 'test' ... # Subtest: opencode: skill results are checked as instruction files (\#2) ok 18 - opencode: skill results are checked as instruction files (\#2) --- duration_ms: 5.454866 type: 'test' ... 1..18 # tests 18 # suites 0 # pass 18 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 8028.744001

• classify a tool call (README Install quickstart): needs a Jev API key; none provided. The documented call was run and exits 3 with 'no credentials' (see probe.json credentials_error)

  Source: README.md Install: jev-guard check Bash '{"command":"rm -rf ~/"}'

  Expected: documented command completes successfully

  Observed: needs a Jev API key; none provided. The documented call was run and exits 3 with 'no credentials' (see probe.json credentials_error)

Local or hosted: local

Run jev-guard's documented safety check on a tool call (jev-guard check Bash '{"command":"rm -rf ~/"}') and get a allow/ask/deny verdict from the Jev model

cd <guest-path> && pwd && ls -la && id -u && (. /etc/os-release; echo $PRETTY_NAME) && python3 --version && git --version; which node npm uv 2>&1; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -300
cd <guest-path> && cat package.json && ls -la .coldpass src test hooks && sudo -n true && echo SUDO_OK; command -v node npm; echo "PATH=$PATH"
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/leepokai/jev-guard 2>&1; timeout 120 git fetch --depth 1 origin cda06c49ceaac207904142ec92bfab793bbd18b1 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short | head; apt-cache policy nodejs | head -3
export DEBIAN_FRONTEND=noninteractive; (curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/ns_setup.sh && sudo -E bash /tmp/ns_setup.sh) 2>&1 | tail -5; sudo apt-get install -y nodejs 2>&1 | tail -3; node -v; npm -v
env | grep -iE 'jev|ai_gateway|openrouter|vercel|proxy' | sed -E 's/=.{0,6}.*/=<set>/' ; ls -la ~/.jev-guard 2>&1; cd /tmp && timeout 20 curl -sS -o /dev/null -w '%{http_code}\n' https://api.typesafe.ai/ 2>&1; timeout 20 curl -sS -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/jev-guard 2>&1
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 300 npm i -g jev-guard 2>&1 | tail -5; echo "rc=$?"; command -v jev-guard; jev-guard --version 2>&1 | head -3; npm root -g
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 300 npm i -g jev-guard 2>&1 | grep -iE 'error' | head -15
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 300 sudo -E npm i -g jev-guard 2>&1 | grep -v notice | tail -3; command -v jev-guard; jev-guard --version 2>&1 | head -3; jev-guard --help 2>&1 | head -30
cd /tmp && timeout 60 jev-guard check Bash '{"command":"rm -rf /"}'; echo "rc=$?"; echo ---; echo 'hello' | timeout 60 jev-guard scan; echo "rc=$?"
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 300 npm test 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"; echo ---; grep -rniE 'cron|schedul|setInterval|--once|--now|webhook|loop' src hooks extensions .claude-plugin .codex-plugin .cursor-plugin 2>/dev/null | head -20
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 300 npm test 2>&1 | grep -B2 -A25 '^not ok\|  not ok' | head -60
cd <guest-path> && sed -n 255,290p test/guard.test.js
cd <guest-path> && H=$(mktemp -d) && HOME=$H timeout 60 node src/cli.js install claude; echo "rc=$?"; ls -la $H/.claude 2>&1; grep -n 'claude' src/cli.js src/hook.js | head -20; command -v claude || echo "no claude cli"
cd <guest-path> && H=$(mktemp -d) && HOME=$H node src/cli.js install claude >/dev/null 2>&1; grep -c 'jev-guard' $H/.claude/settings.json; grep -o '"command": *"[^"]*"' $H/.claude/settings.json | head -3; cat -A /dev/null; cat $H/.claude/settings.json | head -20
rm -rf /tmp/jevcheck && mkdir -p /tmp/jevcheck && cp -r <guest-path> /tmp/jevcheck/jev-guard && cd /tmp/jevcheck/jev-guard && rm -rf .git && timeout 300 npm test 2>&1 | grep -E '^# (tests|pass|fail)'; echo "rc=${PIPESTATUS[0]}"
set -e; cd <guest-path>
cat > probe.json <<'EOF'
{"checks":[
 {"check":"install","kind":"cli","argv":["jev-guard","--help"],"cwd":"<guest-path>","expected_text":"dangerous-action guard"},
 {"check":"credentials_error","kind":"cli","argv":["jev-guard","check","Bash","{\"command\":\"rm -rf ~/\"}"],"cwd":"<guest-path>","expected_returncode":3,"expected_text":"no credentials"}
]}
EOF
cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"install writes the guard hooks into the agent's user config","source":"`install` is idempotent and writes the absolute path of the current `node`","input":"jev-guard install claude with HOME set to a scratch directory","expected":"settings.json written under the scratch HOME","probe_kind":"cli","argv":["jev-guard","install","claude"],"env":{"HOME":"<guest-path>"},"expected_text":"jev-guard: written to","cwd":"<guest-path>"},
 {"kind":"claim","claim":"the offline test suite runs against a fake Jev","source":"node:test with a fake Jev","input":"npm test in a checkout directory named jev-guard","expected":"all 18 tests pass","probe_kind":"cli","argv":["npm","test"],"expected_text":"# fail 0","cwd":"/tmp/jevcheck/jev-guard"},
 {"kind":"claim","claim":"check exits with a verdict code","source":"Assess one tool call; exit 0 allow, 1 ask, 2 deny","testable":false,"reason":"needs a Jev API key (TypeSafe, Vercel AI Gateway or OpenRouter); none is available in this guest, so the CLI exits 3 with 'no credentials'"}
]
EOF
cat > examples.json <<'EOF'
[
 {"kind":"example","claim":"offline test suite (README Development section)","source":"README.md Development: npm test","input":"npm test in a copy of the checkout named jev-guard (the snapshot path 'workspace' makes one install-path test fail)","expected":"18 of 18 tests pass","argv":["npm","test"],"cwd":"/tmp/jevcheck/jev-guard","expected_text":"# fail 0"},
 {"kind":"example","claim":"classify a tool call (README Install quickstart)","source":"README.md Install: jev-guard check Bash '{\"command\":\"rm -rf ~/\"}'","reason":"needs a Jev API key; none provided. The documented call was run and exits 3 with 'no credentials' (see probe.json credentials_error)"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: src/cli.js commands (hook, acp, check, scan, scan-skills, install, key), README CLI section, hooks/*.json. jev-guard runs as a per-tool-call hook invoked by the host agent, with no cron, scheduler, loop, --once/--now or webhook; src/session.js notes 'no scheduler'. No product cycle to trigger.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open(f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"
rm -rf /tmp/tmp.uRrlE0yVsa; ls -la
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
set -e; cd <guest-path>
cat > probe.json <<'EOF'
{"checks":[
 {"check":"install","kind":"cli","argv":["jev-guard","install","claude"],"cwd":"<guest-path>","env":{"HOME":"<guest-path>"},"expected_text":"jev-guard: written to"},
 {"check":"credentials_error","kind":"cli","argv":["jev-guard","check","Bash","{\"command\":\"rm -rf ~/\"}"],"cwd":"<guest-path>","expected_returncode":3,"expected_text":"no credentials"}
]}
EOF
cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"install writes the guard hooks into the agent's user config","source":"`install` is idempotent and writes the absolute path of the current `node`","input":"jev-guard install claude with HOME set to a scratch directory","expected":"settings.json written under the scratch HOME","probe_kind":"cli","argv":["jev-guard","install","claude"],"env":{"HOME":"<guest-path>"},"expected_text":"jev-guard: written to","cwd":"<guest-path>"},
 {"kind":"claim","claim":"check exits with a verdict code","source":"Assess one tool call; exit 0 allow, 1 ask, 2 deny","testable":false,"reason":"needs a Jev API key (TypeSafe, Vercel AI Gateway or OpenRouter); none is available in this guest, so the CLI exits 3 with 'no credentials'"}
]
EOF
python3 -I -c "import json;[json.load(open(f)) for f in ['probe.json','claims.json']];print('json ok')"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json,sys
t=open('<guest-path>').read()
i=t.find('{')
try:
  d=json.loads(t[i:])
  print('valid:',d.get('valid')); [print('PROBLEM:',p[:600]) for p in d.get('problems',[])]
except Exception as e: print(t[:3000])
"
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"needs_credentials",
 "fault_owner":"prerequisite",
 "operation":"Run jev-guard's documented safety check on a tool call (jev-guard check Bash '{\"command\":\"rm -rf ~/\"}') and get a allow/ask/deny verdict from the Jev model",
 "operation_scope":"Installed the published npm package globally on Ubuntu 24.04 (Node 22.23.4, npm 10.9.9). Ran the local, credential-free parts: install claude into a scratch HOME (works), and the offline test suite (18/18 pass in a copy named jev-guard). The live Jev verdict could not run because no Jev API key (TypeSafe, Vercel AI Gateway or OpenRouter) is available in this guest.",
 "steps":[
  "git init; git remote add origin https://github.com/leepokai/jev-guard; git fetch --depth 1 origin cda06c49ceaac207904142ec92bfab793bbd18b1; git reset --mixed FETCH_HEAD",
  "README Install prerequisite: node >= 20.3 (package.json engines). Ubuntu default nodejs is too old; installed Node 22 via NodeSource setup_22.x and apt-get install nodejs (v22.23.4, npm 10.9.9)",
  "README Install: npm i -g jev-guard (run as sudo -E npm i -g jev-guard, see deviations); jev-guard installed at /usr/bin/jev-guard",
  "README CLI: jev-guard check Bash '{\"command\":\"rm -rf ~/\"}' -> exit 3, 'jev-guard: no credentials: run `jev-guard key <key>` or set JEV_API_KEY / AI_GATEWAY_API_KEY'",
  "README Install: jev-guard install claude (HOME set to a scratch dir) -> 'jev-guard: written to .../.claude/settings.json'",
  "README Development: npm test -> 18 tests, 18 pass when the checkout directory is named jev-guard"
 ],
 "deviations":[
  "Ubuntu 24.04 apt nodejs is below the required Node 20.3; installed Node 22 from NodeSource (setup_22.x) instead.",
  "npm i -g jev-guard as non-root failed with EACCES on /usr/lib/node_modules; reran the same README command with sudo -E.",
  "npm test in <guest-path> 17/18 passed. The failing test (install writes valid config for every target) asserts the hook config contains the string 'jev-guard'; the hook command embeds the checkout path, which here ends in 'workspace', not 'jev-guard'. A copy at /tmp/jevcheck/jev-guard passes 18/18. This is a path artifact of the snapshot directory, not a product defect.",
  "No Jev credential provided or obtained; the documented check/scan operations were not exercised live (credentials_error recorded instead).",
  "The checker's replay of the install claim wrote its settings.json under <guest-path> (the checker's HOME override was not applied); this is outside the workspace."
 ],
 "stuck_step":"jev-guard check Bash '{\"command\":\"rm -rf ~/\"}' (the product's core operation) exits 3: no Jev API key configured.",
 "main_blocker":"No Jev API key (JEV_API_KEY, AI_GATEWAY_API_KEY, or jev-guard key) is available in this guest, and the product cannot judge a tool call without one.",
 "plain_failure":"The guard's main job, asking the Jev model whether a command is safe, could not be run live because the product needs a Jev account key and none was provided. Install, the local hook configuration, and the offline test suite work.",
 "suggested_fix":"Provide a TypeSafe, Vercel AI Gateway or OpenRouter key (export JEV_API_KEY or run jev-guard key) and rerun the check and scan commands from the README. Separately, make the 'install writes valid config' test not depend on the checkout directory name."}
EOF
python3 -I -c "import json;json.load(open('report.json'));print('report ok')"; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json
t=open('<guest-path>').read(); d=json.loads(t[t.find('{'):])
print('valid:',d.get('valid')); [print('PROBLEM:',p[:400]) for p in d.get('problems',[])]"; ls -la <guest-path>