# @davehardy20/pi-safe-tools

Pi safety bundle: safe command runners, damage prevention, and secret redaction.

## What it adds

### Safe command runners

Seven trusted tool wrappers that bypass bash and invoke executables directly with validated arguments:

- **run_biome** — Biome lint/format check
- **run_vitest** — Vitest test runner
- **run_typecheck** — TypeScript `tsc --noEmit`
- **run_pytest** — pytest test runner
- **run_cargo_test** — Cargo test runner
- **git_safe** — Restricted git operations (status, diff, add, commit, push, init) with secret-scan preflight
- **gh_safe** — Restricted GitHub CLI operations (repo create, PR create/edit/merge/view)

### Damage prevention (rm-rf-blocker)

Intercepts every `tool_call` event and evaluates it against configurable rules:

- Blocked command patterns (hard block)
- Whitelist-mode bash policy (deny-by-default)
- Zero-access path restrictions
- Read-only path enforcement
- No-delete path enforcement
- Secret scanning in git add/commit/push
- Confirmation prompts for dangerous commands

Rules are loaded from `~/.pi/damage-prevention-rules.yaml` (global) and `.pi/damage-prevention-rules.yaml` (project-local).

### Secret guard

Redacts secrets from four surfaces:

1. **User input** — before it enters the session
2. **Context messages** — before they are sent to the LLM
3. **Bash tool calls** — before commands execute
4. **Tool results** — before they are stored in conversation history

Secret patterns cover API keys, tokens, credentials, and generic secret assignments.

### Status command

- **/safe-tools-status** — reports package name, version, source path, and loaded rule counts

## Install

From a local checkout during development:

```bash
pi install /Users/dave/tools/pi-safe-tools
```

From git:

```bash
pi install git:github.com/davehardy20/pi-safe-tools
```

From npm:

```bash
pi install npm:@davehardy20/pi-safe-tools
```

For one run only:

```bash
pi -e /Users/dave/tools/pi-safe-tools
```

## Settings

The damage prevention rules are configured via `damage-prevention-rules.yaml`:

- **Global**: `~/.pi/damage-prevention-rules.yaml`
- **Project**: `<project-root>/.pi/damage-prevention-rules.yaml`

See the bundled default rules in `src/shared/damage-prevention-rules.ts` for the full schema.

The secret guard uses compiled regex patterns from `src/shared/secret-patterns.ts`.

## Troubleshooting

Run `/safe-tools-status` to confirm:

- package name and version
- loaded source path
- damage-prevention rule source (default/global/project)
- total rule count

If commands appear twice, Pi may be loading both the package and the old local extension. Disable or remove the old local auto-discovered extensions (`safe-command-tools.ts`, `rm-rf-blocker.ts`, `secret-guard.ts`) from `~/.pi/agent/extensions/` before reload verification.

## Update flow

1. Update the package repo
2. Push to GitHub
3. Run `pi update --extensions` or reinstall the package
4. Run `/reload`

`/reload` alone does not fetch newer package commits.

## Build and test

```bash
npm run typecheck
npm run build
npm test
```