Posted 2026-05-21 · Updated 2026-06-06 · ~5 min read

JSO AI is live for previews and BYO provider keys.

Published 21 May 2026 · Updated 6 June 2026

The JSO AI surface is now available in two modes. Anyone can use the browser previews to see the answer shape without an API key. Signed-in accounts can save their own OpenAI or Claude key in the dashboard and run live AI through the same JSO endpoints.

What is available now

• preset-suggest helps turn a plain-language project description into starter protection settings.
• compat-check reviews JavaScript for patterns that may break after protection, such as dynamic code execution, reflection-heavy framework code, or source-map leakage.
• explain-error turns a protected-output runtime error into a likely cause and practical next step.
• usage exposes current-month AI usage counters for dashboards and monitoring.

All four endpoints use the same APIKey + APIPwd authentication as the obfuscation API. The response envelope is locked by /docs/ai-wire-format.schema.json and the polyglot smoke harness, so client integrations can validate the shape in CI.

Preview pages do not need a key

The browser previews run the same rule-based guidance locally, so evaluators can see the product shape before connecting a provider key or API account.

• Preset Assistant Preview
• Compatibility Check Preview
• Explain Error Preview

Live AI uses your provider key first

Open AI Settings, choose OpenAI or Claude, and save a provider key. JSO encrypts the key before storage and never shows it again after save. Provider billing stays with the OpenAI or Claude account that owns the key, while JSO tracks usage so the dashboard can show activity and limits.

Managed JSO AI plans are separate from the core obfuscation plans. They are visible on premium-membership.aspx, but online checkout is available only when managed AI billing is enabled for the account. When checkout is disabled, the dashboard points users to BYO setup or support instead of sending them to checkout that cannot complete.

Observability is part of the contract

The usage endpoint and Prometheus textfile exporter let teams track AI usage where they already watch build and runtime systems.

* * * * * JSO_API_KEY=... JSO_API_PASSWORD=... \
    /usr/bin/node /opt/jso/jso-ai-quota-exporter.js \
    --out /var/lib/node_exporter/textfile_collector/jso_ai.prom

The exporter records scrape success, action use, token use, quota caps, and quota rejections. Cookbook recipe 13 has the full setup.

How this changes the CLI

The AI compatibility check can run before protection. Add --ai-precheck to the existing jso-protector command and the CLI scans input files before spending obfuscation quota.

jso-protector --config jso.config.json --ai-precheck --ai-precheck-fail-on error

The standalone variant, jso ai compat-scan, remains available when teams want to run the gate separately from the protection step.

What is next

Phase 1 now focuses on making the BYO-key account path smoother: key testing, clearer usage states, better dashboard copy, and predictable fallback to preview mode when no provider key is available. The wire envelope does not change. provider shifts from rule-based to claude-byo or openai-byo for accounts using their own key.

Phase 2 is the Resistance Score: a planned adversarial probe that reports how much useful structure a named attacker recovers from protected output. That should be evidence a team can audit, not just a marketing claim.

Follow along

The release cadence is visible at /changelog.aspx and subscribable via RSS. The shipping roadmap is at /roadmap.aspx.

For help choosing BYO setup or a managed AI tier, contact support.

Frequently asked questions

What can I try without an account or a key?

The browser previews. They exist so you can see the shape of each answer before deciding whether it is useful, and they need neither a signed-in account nor a provider key. That covers turning a plain-language description of a project into starter protection settings, reviewing code for patterns that may break after protection, and the other preview surfaces described above.

What does bringing my own provider key change?

It turns the same endpoints from preview responses into live answers for your account. A signed-in account can save an OpenAI or Claude key in the dashboard, after which the AI endpoints return provider-backed results rather than preview output. The endpoints and their shapes do not change, so anything built against the preview keeps working when a key is added.

Is managed billing required to use any of this?

No. Bringing your own provider key is the primary activation path, and managed checkout is optional, appearing only when billing is enabled for the account. If you already hold a provider account, saving that key is the shorter route and keeps the provider relationship with you.

Where does my code go when I use these features?

To whichever provider your key belongs to, through the endpoints described here, which is the reason the key is yours rather than ours. If your policy restricts where source may travel, that is the question to settle first, and it is the same question any assisted tooling raises. The preview surfaces are the way to evaluate the feature shape without sending anything you would not want to send.

What does observability mean in this context?

That the calls are visible to you rather than happening invisibly on your behalf. Usage, errors and the outcome of each request are recorded so you can see what ran, which matters when a provider key with real cost attached is involved. Treat it the same way you would any other outbound integration: something whose activity you can account for.

How does this change the command line workflow?

The AI features become available from the same tooling rather than only in a browser, so a check can run where the rest of your build runs. The practical use is a pre-flight review before a protected build, catching patterns that are likely to need an exclusion, rather than diagnosing after something breaks. It is advisory input to a decision, not a gate on your pipeline.