@oisin-ee/pi-guardrails

Agent guardrails for pi, Claude Code, and Codex: Git safety, no waiting, no typing into other agents, GitOps-only clusters.

Packages

Package details

extension

Install @oisin-ee/pi-guardrails from npm and Pi will load the resources declared by the package manifest.

npm repo report
$ pi install npm:@oisin-ee/pi-guardrails
Package
@oisin-ee/pi-guardrails
Version
0.7.2
Published
Oct 19, 2026
Downloads
863/mo · 863/wk
Author
oisincoveney
License
MIT
Types
extension
Size
130.4 KB
Dependencies
0 dependencies · 1 peer
Pi manifest JSON
{
  "extensions": [
    "./src/pi/index.ts"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

@oisin-ee/pi-guardrails

Agent guardrails for pi, Claude Code, and Codex. One set of policies checks every shell and edit call:

  • Git safety: no --no-verify, no discarding uncommitted work, no stash push and pop in one command, worktrees only under .worktrees/, no on-the-fly identity.
  • Wait gate: no sleep, watch, follow flags, --wait/--watch, or wait subcommands. Start long work in the background instead.
  • Agent typing: no herdr agent prompt or pane send-* into another agent's terminal. Use dogsled send. For prompt answers, only herdr agent send-keys accepts # dogsled: answer-prompt; each use is recorded.
  • GitOps: no imperative kubectl, helm, argocd, or nix mutations, and no fsck/mkfs.
  • Generated paths: no hand-edits of lockfiles or generated files.

In pi, it also fills a missing shell timeout (120 s) and blocks one above 10 minutes, naming each tool's unit. Shell text is parsed with shfmt, which must be on PATH. A command that cannot be parsed is blocked.

pi

pi install npm:@oisin-ee/pi-guardrails

Claude Code and Codex

Install the package globally, then run agent-hook as a PreToolUse hook for shell and edit tools. It reads the hook payload on stdin and exits 2 with the reason on stderr to block.

{ "type": "command", "command": "agent-hook", "timeout": 30 }