pi-git-commit

Keeps mutative git operations out of the agent's bash and provides a safe, reviewable commit flow in pi-coding-agent: a bash guard, a git_commit tool, and /commit + /toggle-allow-git commands.

What you get

• Bash git guard. Mutative git commands are blocked in the agent's bash tool — add, stage, commit, push, pull, merge, rebase, reset, clean, rm, restore, switch, cherry-pick, revert, mv, init, clone, index/object plumbing (read-tree, checkout-index, merge-file, prune-packed), plus mutative forms of branch (including creation, -u, -f, -c/-C/--copy, -D/-M, --force, -t/--track), tag (including creation), checkout (including whole-tree restores like checkout -- .), stash, submodule, worktree, config, remote, apply, notes, update-ref, gc and more. Read-only commands (status, diff, log, fetch, branch, tag, stash list, ...) stay allowed.
• git_commit tool. The agent stages everything and commits with a FIX / IMPROVE / NEW type prefix. Inactive by default: /commit activates it for the commit flow and it is disabled again after use, so the agent cannot commit on its own at other times.
• /commit command. Waits for queued messages to finish, stages all changes, shows the staged diff, activates the git_commit tool, and asks the agent to review it and commit via git_commit — never via bash.
• /toggle-allow-git command. Temporarily allows mutative git commands in bash for the current session. The guard re-arms on the next session.

Quick start

1. Make your changes, then run:

/commit

2. The extension stages the working tree and hands the staged diff to the agent with instructions to review it.

3. The agent commits using the git_commit tool:

{
  "type": "FIX",
  "message": "Correct the off-by-one in the retry loop"
}

4. If you need to run mutative git yourself, allow it for the session:

/toggle-allow-git

Installation

pi install npm:pi-git-commit

From a local checkout:

pi install /path/to/pi-git-commit

The git_commit tool

Field	Description
type	FIX (bug fix), IMPROVE (improvement), or NEW (new feature).
message	Commit message in imperative mood, without the type prefix (it is added automatically). A leading type word matching the chosen type is stripped (with :, whitespace, or -/— separators, any casing, repeats included) so the type is never duplicated. Multi-line allowed for detailed changes.

The tool runs git add . followed by git commit -m "<TYPE>: <message>" and reports staging or commit failures as tool errors. A leading type word in the message is stripped whenever it repeats the chosen type — with :, whitespace, or -/— separators, at any casing, repeated prefixes included — so the type never ends up duplicated: FIX: Fix: ..., FIX: Fix ..., and fix - ... all become FIX: .... The tool is inactive by default and only becomes available when you run /commit; it is deactivated again after a single use (success or failure), so the agent cannot commit at arbitrary points in the conversation. If a commit fails, run /commit again to retry.

The bash guard

The guard intercepts tool_call events for the bash tool and blocks commands that match mutative git forms. The block list is a conservative superset: anything that can change repository state is blocked, while a curated set of read-only forms is explicitly allowed (for example git fetch, git stash list, git remote -v, git config --get, git apply --check, git checkout -- <file>, git submodule status, git worktree list).

The guard parses the command into segments (pipelines, &&, ||, ;, &, command and process substitution, newlines) and inspects only segments that actually invoke git — including path-qualified invocations (/usr/bin/git), wrapper prefixes with their flags (sudo -u root, nice -n 5, timeout 5), environment-assignment prefixes (VAR=1 git ..., env VAR=1 git ...), control constructs ({ ...; }, !, if, while), and sh -c/su -c wrappers — while skipping git's global options such as -C, -c, --git-dir, and --work-tree. Commands nested more than four wrapper levels deep are blocked outright (fail closed), even when no git command is visible. Git commands mentioned inside strings or heredocs are not blocked. Plain git fetch stays allowed, but git fetch --prune/-p/--prune-tags is blocked. Indirect invocation (aliases, variables, find -exec) cannot be detected reliably and is best-effort; likewise a directory passed to git checkout -- without a trailing slash is indistinguishable from a file, so git checkout -- src (restoring the whole src tree) is not caught.

A blocked command returns:

Mutative git commands are blocked. Use /toggle-allow-git to allow for this session.

Troubleshooting

• The agent refuses to commit. The guard blocks git commit in bash by design. Run /commit and let the agent use the git_commit tool.
• "Nothing to commit (empty diff)." There are no staged changes — make edits first, then run /commit again.
• I need git in bash right now. Run /toggle-allow-git; the guard re-arms automatically on the next session start.

Development

Requires Node.js ≥ 22.19 and npm.

npm install
npm test
npm run typecheck

Credits

• badlogic, pi-coding-agent and the tool/command APIs

License

MIT