pi-heed
Pi extension that turns what you say into structured runtime constraints and checks every side-effecting tool call against them.
Overview
pi-heed adds runtime constraints to the Pi coding agent. If you say 'review only, don't touch anything', and forty tool calls and a context compaction later the agent reaches for write, pi-heed stops it and quotes your words as the reason. It treats what you say over a session as a changing policy, kept as structured state: each constraint has a source quote, effect (deny, allow, require confirmation, require before), action (modify, install deps, git push, git commit, custom), resource, scope (session, goal, run, once), exceptions and status.
It handles nested rules such as 'don't touch src, but src/auth is fine, except secrets.ts', one-time permissions, revocations and requirements like running tests before pushing; the most specific resource, then action, then newer instruction wins. Every change is persisted in the session so it survives reloads and compaction. Per the list summaries, it is powered by TypeSafe Jev, which checks each side-effecting call against what you asked for. Examples in the README include Chinese and English instructions.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Would this tool call violate an active user constraint?(inferred) | yes · no |
| Choice | How should this user message change the constraint policy (add, lift, re-apply)?(inferred) | add · lift · re-apply |
How it works
- Extract constraints from user messages into structured state.
- Before each side-effecting tool call, check it against active constraints.
- Block with the user's own words as the reason, or allow.
- Persist constraint changes across reloads and compaction.
Strengths
- Remembers instructions through long sessions and compaction.
- Handles exceptions and scoped permissions.
- Explains blocks with the user's words.
Caveats
- Relies on correct interpretation of natural-language constraints.
- Requires a TypeSafe key.
Getting started
Install the pi-heed extension into Pi and set your TypeSafe key.At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi extension
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
Runtime constraints: checks every side-effecting tool call from the Pi agent against what the user actually asked for.
yibie/awesome-jevRuntime constraints for the pi coding agent: checks every side-effecting tool…
wh000wh000/awesome-jev-liveRuntime constraints for the pi coding agent: checks every side-effecting tool call against what you said, before it runs. Powered by TypeSafe Jev.
hellogumbo/awesome-jevChecks every side-effecting tool call the pi agent is about to make against what you actually asked for, before it runs.
MrJev/awesome-jev
Frequently asked questions
What happens when I change my mind?
The earlier constraint is marked superseded and the new permission applies, with your words recorded.
Does it survive compaction?
Yes, constraint changes are persisted in the session.
Can permissions be one-off?
Yes, scopes include once and run.
Related projects
Local guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptOMP plugin that sends unreviewed bash commands to Jev and turns UNSAFE or UNSURE verdicts into Run-or-Deny prompts.
ProjectbetaTypeScriptPi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
PluginbetaTypeScriptAuto mode for Pi: deterministic policy first, then Jev judges escalated bash/write/edit calls, failing closed when undecidable.
ProjectbetaTypeScriptPi extension that auto-approves routine Bash commands via a System One model and escalates flagged ones, including obfuscated, to a human.
PluginbetaTypeScript