@zenspc/pi-safety

Confirm destructive bash and git actions before Pi runs them.

Install

pi install npm:@zenspc/pi-safety

Local development:

pi -e ./packages/pi-safety
pi install ./packages/pi-safety

What it does

Intercepts risky tool calls and asks for confirmation before allowing them.

Examples of guarded actions:

• rm -rf and other destructive shell deletes, including short flag clusters like rm -fr
• force push / hard reset / commit amend style git history rewrites, even with global options like git -C path push --force
• file tool writes to protected paths: .env*, .git/, node_modules/, .ssh/, .aws/, .gnupg/, .kube/, .config/gcloud/, .config/gh/
• other high-risk bash patterns classified by the extension

Destructive-severity actions always require explicit confirmation. They are never auto-approved based on user message wording; only risky system changes can be pre-approved that way.

Commands / config

Config file:

~/.pi/agent/safety-guard.json

Default:

{
  "enabled": true
}

Limitations

This extension is a best-effort confirmation layer, not a security product claim.

• It confirms a fixed set of destructive or risky patterns. That set is not exhaustive.
• Novel or rephrased commands can slip through the heuristics.
• It can be disabled by the user via ~/.pi/agent/safety-guard.json ("enabled": false).
• It does not isolate the filesystem, network, or credentials.
• It does not replace code review, backups, branch protection, or OS-level isolation.
• Like all Pi extensions, it runs with full local permissions.

Avoid treating it as "makes Pi safe" or as a complete deny-list.

Source

Extension entry:

extensions/safety-guard.ts