Jev Desktop

How we reviewed this: we ran its 123 tests in Docker offline and drove its real policy and candidate-filter modules against crafted inputs. Unlike the rest of this batch it is plain Node, so everything ran. We made no Jev calls.

What it does

It sits inside Codex Computer Use as a plugin. Codex supplies a goal and an allow-list of labels; the plugin filters the accessibility snapshot to matching candidates, asks one request for both the operation and each operation’s target, validates only the selected head, re-observes to confirm nothing moved, and then executes.

Three design choices are worth lifting:

• The model’s “done” is advisory. A local verifier has to agree.
• It re-observes before every mutation and abandons the step if the snapshot changed.
• It has an actual budget. 24 steps, 32 requests, 120 seconds, a confidence floor and a probability floor, plus a 7-second per-request timeout and a 240-candidate cap. Nothing else in this batch has all of that.

The payload is the most restrained we have measured in this category. Field values are not sent — only a boolean saying whether a slot already holds the prepared value. Labels are redacted for credentials and email addresses, nodes matching a sensitive pattern are dropped entirely, and only allow-listed elements are included at all. Screenshots never are.

The allow-list check has a gap

Codex’s allow-list is what makes the whole design safe, so the plugin rejects rules that are too broad:

const broadSamples=['Button','删除文件','__JEV_SCOPE_SENTINEL__'];
…
if(tests(clone,'') || broadSamples.every(value=>tests(clone,value))) throw new Error('MATCH_RULE_TOO_BROAD');

It requires all three samples to match. One of them contains no Latin letters, so /[a-z]/i — a perfectly natural way to write “any label with letters in it” — matches two of three and is accepted. We ran it against a label set: it matched all eleven, including “Place order”, “Move to Bin” and “Revoke access”. /./ and /.*/ are correctly rejected; the one in between is not.

The remaining defence is a hardcoded list of consequential words. We tested that separately: “Checkout”, “Pay now”, “Send” and “Delete” are caught; “Place order”, “Confirm order”, “Move to Trash”, “Revoke access”, “Wire funds” and anything in a language other than English or Chinese are not.

The two gates are in series, so a narrow allow-list keeps you safe. A broad one that passes the check opens both at once.

Verdict

The most disciplined engineering in this group: real tests, real CI, real limits, and a payload designed around what the model needs rather than what is convenient to send. The README also states plainly that it “does not yet prove an end-to-end speedup”, which is rarer than it should be.

Tighten the allow-list yourself rather than relying on the breadth check, and read the consequential list before trusting it in a non-English interface.

For the same problem outside Codex, see Jev-cu and jev-use.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.