pi-kicky-glue

Pi-native agent operating glue for Kicky.

This package bundles Kicky's first layer of Pi harness discipline: safety blockers, workflow reminders, and owned-stack context pointers. It is personal-first and publishable; generic extraction can happen later if the patterns earn it.

What it does

• Blocks dangerous bash before execution: force-pushes, destructive git resets/cleans, direct secret reads, kill-by-port pipelines, and broad rm -rf targets.
• Confirms risky bash when a UI is available: normal git push, gh pr create, kata --done, sed -i, sudo, chmod 777, and recursive deletes.
• Nudges full reads after repeated search/snippet operations. Search locates; reading understands.
• Nudges code pride after code edits. Before final response, reread edited files and check imports, types, control flow, conventions, and owner-grade cleanliness.
• Injects owned-stack pointers when prompts mention Pi, Runline, Dripline, Dripyard, kata, fnox, Omarchy, or Michaelliv.
• Adds commands: /kicky-glue-status and /kicky-glue-config.

No Claude Code dependency. Claude artifacts are source material only; Pi is the harness.

Install

From npm, after publishing:

pi install npm:@kickythrust/pi-kicky-glue

Local dogfood:

pi install /home/kicky/work/studio/kicky/pi-kicky-glue
/reload

Commands

Command	Description
/kicky-glue-status	Show enabled features and lightweight runtime state.
/kicky-glue-config	Show environment config knobs.

Environment config

Env var	Effect
PI_KICKY_GLUE_DISABLE=1	Disable the whole package.
PI_KICKY_GLUE_NO_READ_FULLY=1	Disable repeated-search reminder.
PI_KICKY_GLUE_NO_CODE_PRIDE=1	Disable post-edit code-pride reminder.
PI_KICKY_GLUE_NO_DANGEROUS_BASH=1	Disable bash blocker/confirmation gate.
PI_KICKY_GLUE_NO_CONTEXT=1	Disable owned-stack pointer injection.
PI_KICKY_GLUE_READ_THRESHOLD=3	Change repeated-search threshold. Default: 2.

Safety behavior

Hard-blocked by default:

• git push --force / --force-with-lease
• git reset --hard
• forceful git clean -fd
• lsof -ti:<port> | xargs kill
• direct secret reads such as fnox get, psst get, op read, cat .env, env, printenv
• broad rm -rf /, rm -rf ~, rm -rf $HOME

Confirmed in TUI/RPC, blocked in non-interactive modes:

• ordinary git push
• gh pr create, kata --done, npm version
• sed -i / sed redirect editing
• sudo
• chmod/chown 777
• recursive deletes not covered by the hard block

Package shape

pi-kicky-glue/
├── extensions/index.ts      # Pi extension entrypoint
├── src/                     # Pure tested modules
├── skills/kicky-glue/       # Skill docs loaded by Pi
└── tests/                   # Bun tests for pure modules

Development

bun install
bun test
bun run typecheck
npm pack --dry-run

Why this exists

Michael's dotfiles showed the real lesson: the agent stack needs glue, not more tools. Small reminders and hard blockers keep the model inside the operator's discipline.

For Kicky, that glue belongs in Pi.

License

MIT