pi-typesafe-approve
Pi extension that auto-approves routine Bash commands via a System One model and escalates flagged ones, including obfuscated, to a human.
Overview
pi-typesafe-approve puts a fast System One triage layer in front of every Bash command in Pi. Routine commands such as ls, git status or npm ci pass without a prompt; commands the model flags, including obfuscated ones it decodes like hex-escaped rm -rf or base64-piped shell, stop and go to the user; and when the model is unreachable, the gate does not wedge the agent. The model returns a choice tier, a noul yes/no probability and a confidence.
Endpoints, models and keys are fully user-supplied with no provider presets, because known deployments share the request body but differ in paths and model ids; you set baseUrl plus path or an absolute endpoint via the /typesafe-approve menu. Decisions are logged to a decisions.jsonl file with 0600 permissions, capped at 20 MB by atomically keeping the newest 10 MB. It can be installed from git or loaded from a local checkout for development.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Which risk tier is this Bash command? | — |
| Yes / no | Should this command go to a human? | yes · no |
How it works
- Intercept a Bash command.
- Ask the System One model for tier and approval probability.
- Auto-approve routine commands; escalate flagged ones.
- Log the decision; continue if the model is unreachable.
Strengths
- Detects obfuscated dangerous commands.
- Works with any compatible deployment.
- Bounded decision log.
Caveats
- Behaviour when unreachable is to not block, reducing protection.
- Requires configuring endpoint and model manually.
Getting started
pi install git:github.com/Davidasx/pi-typesafe-approve, then /typesafe-approve to set endpoint, model and key.At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi extension
- Has code
- yes
Use cases and integrations
How curated lists describe it
Pi extension: auto-approve routine Bash commands with a System One (Jev) decision model, escalate the rest to a human.
hellogumbo/awesome-jev
Frequently asked questions
Which commands pass automatically?
Routine ones the model does not flag, such as ls or git status.
Are there provider presets?
No, endpoint, model and key are user-supplied.
Where are decisions logged?
In decisions.jsonl beside the config, capped at 20 MB.
Related projects
Local guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptOMP plugin that sends unreviewed bash commands to Jev and turns UNSAFE or UNSURE verdicts into Run-or-Deny prompts.
ProjectbetaTypeScriptPi extension that turns what you say into structured runtime constraints and checks every side-effecting tool call against them.
PluginbetaTypeScriptPi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
PluginbetaTypeScriptAuto mode for Pi: deterministic policy first, then Jev judges escalated bash/write/edit calls, failing closed when undecidable.
ProjectbetaTypeScript