jev-crawlers

# jev-crawlers

Small unix tools for bug-discovery, powered by Jev. One tool, one job, JSON lines on stdin/stdout, composed with pipes.

AI writes code faster than humans can review it. Linters match patterns. One-shot AI reviewers read a diff once and stop. Few tools follow the lead: they never ask "who else calls this?", "what config changes it?", "where does this input become trusted?" These tools do, and keep going until the lead dries up.

The trick is cheap judgment. [Jev](https://vercel.com/docs/ai-gateway) (typesafe-ai/jev, via the Vercel AI Gateway) returns typed verdicts, choice, boolean, and score, for about $0.00006 per normal node in our calibration runs. When each judgment costs a fraction of a cent, you can judge every node instead of every scan.

## The tools

Each tool reads JSON lines on stdin and writes JSON lines on stdout. They compose with plain shell pipes:

```
jev-seed --repo X | jev-judge | jev-verify | jev-report
```

- **jev-seed**: emits starting leads, one per line. Sources: the current diff, TODO and FIXME comments, and risky patterns (auth, money movement, eval, shell). Human false-positive verdicts (`data/fp-verdicts.json`) suppress exact repeats; suppressions log to stderr.
- **jev-expand**: follows context cues from one lead. It finds symbol references (callers), files that change together in git history, and config files that name the symbol. Mechanical. No model calls.
- **jev-judge**: one Jev call per node. Typed answers: a `verdict` suggestion
  (expand, report, prune, escalate), a `bug_likely` ranking signal, a `risk`
  score from 0 to 3, and whether a falsifiable artifact is stated. Routing
  follows the risk bands; no route is gated on a raw boolean. Recent
  human false-positive verdicts ride along as negative examples.
- **jev