Persistent workspace confinement for Pi tool calls.
Pi extensions and AI-invoked tools run with your user permissions. A mistaken, overly broad, or malicious tool call can therefore read sensitive files or modify data outside the project you intended Pi to work on. Filesystem paths also need canonical checking because relative paths and symlinks can escape a workspace even when the original path appears local.
This extension adds a fail-closed guard before tool execution. It canonicalizes paths, confines writes to Pi's current workspace, requires interactive approval for outside reads, rejects outside reads when approval is unavailable, and blocks AI shell commands because arbitrary shell text cannot be reliably restricted with path inspection alone. /pathguard on|off controls the guard; the setting persists across Pi sessions and defaults to on if its state file is missing or invalid.
This reduces accidental workspace escape. It is not an OS sandbox: turning it off removes these checks, and other extensions or unhandled tools may still access the system with your permissions.
When enabled, the extension:
- blocks AI
bashtool calls - blocks
writeandeditoutside the current workspace - asks before reads outside the workspace in interactive sessions
- denies outside reads in non-interactive sessions
- resolves symlinks and existing path ancestors before checking containment
The guard defaults to on when no valid saved state exists.
pi install git:github.com/nor1c/pi-workspace-path-guardRestart Pi, or run /reload in an existing session.
To install a tagged release:
pi install git:github.com/nor1c/pi-workspace-path-guard@v1.0.0/pathguard on
/pathguard off
/pathguard
/pathguard without an argument reports current state. State persists across sessions in:
~/.pi/agent/workspace-path-guard.json
Disabling the guard permits tool activity that this extension would otherwise block. Pi extensions execute with your user permissions; review extension source before installation.
MIT