pi-boundary

Filesystem boundary enforcement for pi. Prompts you before the agent reads or writes files outside your project.

How it works

On session start, pi-boundary detects your project boundary:

1. Runs git rev-parse --show-toplevel to find the git worktree root
2. Falls back to the current working directory if not in a git repo

Then it intercepts every file tool call (read, write, edit, grep, find, ls):

• Inside boundary → allowed silently
• Outside boundary → you get a confirmation prompt
• Previously approved directory → allowed silently (remembered for the session)

🔒 pi-boundary: path outside project

Tool: read
Path: /Users/you/.ssh/config
Boundary: /Users/you/project

Allow this access? (y/n)

When you approve, the parent directory is remembered for the rest of the session.

Install

# As a pi package
pi install npm:pi-boundary

# Or test locally
pi -e ./pi-boundary/extensions/index.ts

Limitations

• No bash coverage — the bash tool is not intercepted. The agent can still access files outside the boundary via shell commands. This will be addressed in a future version.
• Session-scoped memory only — approvals reset when you start a new session.
• No configuration — the boundary is always the git worktree root (or CWD). Custom boundaries and allow/deny patterns are planned for a future version.

Development

cd pi-boundary
npm install
npm test

License

MIT