The optional second opinion on a session: what it checks, what it sends to Venice, what it costs, and what it can never do.
Cloakster asks Venice’s decision model, Jev, a few fixed questions at three moments: when you send a message, after a turn settles, and when an approval card opens. It shows the answers as lines and cards. Watching is off by default. Two checks under the same heading start on: the vague-request check, and a local follow-up when the agent claims a change it did not make. It never approves or skips a tool call. It adds lines and cards. On a vague request it tells the agent to ask you first. Only if you turn them on does it pause a looping run or set the effort level.
Where it is on
Settings › General › Cloakster › Watch each session. The checks after a turn and on a card each have a switch. The three before a turn share “Judge each request before the turn”. The rules check runs whenever watching is on. Cloakster stays off for any end-to-end encrypted session and any incognito chat, and while Venice has not yet said which privacy tier a model is on. It also pauses on any thread whose model is more private than Jev, which means every Private and Encrypted model, so it watches only threads on Anonymized models.
What it checks
When you send a message, as its turn starts (the turn does not wait):
Check
Fires when
What you see
Size
The request reads as large or architectural, and the read is sure
A line suggesting a plan first, with a Plan first button on the Claude engine
Too vague
The request leaves out where the work belongs, or what the result should be
A line naming the one thing to add: where, what it should do, how to check it, or what must not change; on the Claude engine the agent is told to ask you before editing
Touches data or deployment
The request involves data, deployment, releases, secrets, shared history or money
A line saying Cloakster will flag the calls that do
With “Set effort from the request” on (off by default, Claude engine only), the effort follows the size of each message you send, when Jev is at least 50% sure of the size: low for trivial, medium for small and moderate, high for large, higher still for architectural. It stays until the next judged message moves it or you pick one yourself. The model never changes.
After every settled turn, on any engine:
Check
Fires when
What you see
Looping
The recent turns repeat the same command, edit or error without progress
A notice with Stop, Back to the request, Dismiss
Drift
The work serves a goal your request did not ask for
A notice quoting your request, with Back to the request and Stop
Unbacked
The last message claims a result no tool output or edited file supports
A notice with Back to the request
Stuck
The agent retries an approach its own results already showed failing, without a new reason
A notice with Re-plan and Stop
Done
Everything asked for is finished, the checks that ran passed, and the turn changed files
A notice with Review changes; never a stop
With “Pause after three looping turns” on (off by default), three looping turns in a row stop the run the way Stop does; your next message resumes it.
When an approval card opens, within a 2.5 second box so the card never waits:
Check
Fires when
What you see
Outside the task
The call touches files, projects or systems the request does not need
A line on the card
Cannot be undone
The call deletes, discards or overwrites something nothing keeps a copy of
A line on the card
Sends something out
The call uploads, publishes or pushes to a place the request did not name
A line on the card
The card’s choices are the same with or without the lines.
After a turn that edited files, the rule lines in the project’s CLAUDE.md, AGENTS.md and .claude/CLAUDE.md (up to 40) are each asked against the changed lines. A rule the change likely breaks is a card naming it, with “Ask to fix”, which sends the rules to the agent as your message.
On the Claude engine, when Cloakster may read the thread, Jev helps write the session headline, the line under a running thread in the sidebar. It picks one of nine activities from the last tool actions, and Cloaky writes the line from the last action. Otherwise Cloaky writes the line from the last action alone, with no model call.
What it sends
What is in a request, and what never isFig. 6
In the request
Each message you send, judged before its turn, with the thread's first message beside it
Your first message in the thread, cut to 2,000 characters
Up to three later messages, 500 characters each
The most recent replies, tool calls and tool results, up to 24,000 characters, oldest dropped first
The paths of files this turn edited
When a card is open: the pending call, the paths the session edited, and, for a write inside the project, whether it replaces a file that exists
The project's folder path
On the Claude engine, for the headline: the first 240 characters of the task and the last twelve tool actions, with credentials masked
After a turn that edited files: the rule lines of the project's CLAUDE.md, AGENTS.md and .claude/CLAUDE.md, and the change as git shows it, credentials masked; files named like .env or a private key never
Never in it
Anything from before you switched Cloakster on: no transcript is kept while it is off
Anything from a thread on a Private or Encrypted model, or from an incognito chat
Your other threads and projects
Your Venice key, beyond the same header every Venice request carries
The answers: Venice returns probabilities and keeps neither the request nor the reply
The questions are fixed text in the app. Nothing from a session is ever pasted into them; the session is data, in named fields, and only data.
Requests go to POST https://api.venice.ai/api/v1/decisions, model jev-latest, on your own key. Venice returns probabilities and keeps neither the state nor the answers. Jev’s tier is anonymized, one step below a private model’s, so Cloakster sends nothing from a thread on a Private or Encrypted model. On a Private model, only the vague-request check runs, on the thread’s own model. The full row is on the privacy page.
What it costs
Input tokens are billed at Jev’s listed price; output is free. A verdict is about 990 input tokens, roughly 0.004 cents at the list price of $0.042 per million input tokens. Settings › Usage shows the total as a “Cloakster, N tokens” tile.
When it fires
Each check has a fixed bar, set on labelled examples sent to the live model. A notice fires at or above the bar; after you dismiss one, the same kind needs the bar plus 0.1 before it returns in that session.
Check
Fires at
Too vague
0.95 (where) / 0.8 (what)
Touches data or deployment
0.7
Size (plan first)
large or architectural, confidence 0.5 or more
Looping
0.75
Stuck
0.7
Rules
0.7
Drift
0.7
Unbacked
0.75
Done
0.8
Outside the task
0.7
Cannot be undone
0.6
Sends something out
0.5
The examples behind the barslast tuning run
Looping
51 examples · 9 with the problem
Drift
51 examples · 6 with the problem
Done
51 examples · 18 with the problem
Unbacked
51 examples · 4 with the problem
Stuck
51 examples · 7 with the problem
Outside the task
52 examples · 23 with the problem
Cannot be undone
52 examples · 12 with the problem
Sends something out
52 examples · 12 with the problem
problem presentno problemwhere it fires
How big the model read each requestFig. 3 · 40 requests
read on the labelled rungread on another rungthe diagonal
25 of 40 land on the diagonal and 38 within one rung. The two that miss by more are requests that destroy data, labelled small by effort and read as large by consequence. The plan-first line fires on those too, which is the right side to err on.
What it keeps
What Cloakster said and what you did with it (kinds, probabilities, turns and actions, never text) is appended to audit/cloakster.log on this machine, and cleared by Start fresh. Nothing is written for an incognito chat.
Known limits
A finish whose author ran no check, and a new file created in a neighbouring project, sit under their bars and are not flagged.
A push you did not ask for gets “sends something out”; a force-push or a deleted branch gets “cannot be undone” as well.
Only the turns Cloakster watched are in the window. Turning it on mid-session starts from nothing.
The size read puts a request that destroys data on a higher rung than its effort warrants, so “plan first” can appear on a one-line delete. That is the side to err on.
The headline names an activity and a file, “Editing tokens.ts”, not the intent.
The rules check reads the changed lines only, so a rule about something the change did not touch cannot fire, and a breach that lives in an unchanged file is not seen.
The model can be steered by text in the session that argues for its own verdict. The worst that steering can do is a spare notice; nothing it says can allow a tool.
What it never does
Approve a tool call. Send the agent anything but the instruction to ask you about a vague request. Change the model. Skip a card or change its choices. Read turns from before it was switched on. Hold up a run when Venice does not answer: the run continues as if Cloakster were absent, and the card says why. The only things it changes on a run are the effort level and a pause after sustained looping, each only after you turn it on by name.
