Pi: change the agent, keep the model
Published
Pi is a coding agent: it runs tools around an AI model. A TypeScript extension can inspect a requested tool call and block it before execution.
Explanation & code
The companion uses Pi 0.87.0 with its real extension loader, event runner and write tool, but simulated model requests. This write-tool hook is not a sandbox and does not stop every route to a file.
Understand it. Then fix it.
Separate the model from its harness
A harness is the surrounding program that gives a model tools and runs them. Pi extensions add application code without replacing the model.
Inspect the requested tool
The example file menu.txt contains coffee. The request asks the write tool to replace it with tea. This extension checks the tool name and resolved path; isMenu is our custom path helper.
pi.on("tool_call", (event, ctx) => {
if (!isToolCallEventType("write", event)) return;
if (isMenu(event.input.path, ctx.cwd))
return { block: true, reason: "Menu is locked" };
});Observe both outcomes
For menu.txt, the extension blocks the request before the writer runs: zero writes, still coffee. For notes.txt, the same hook permits the write and the real write tool creates the file.
Do not confuse a hook with isolation
The shell, edit tool or another route can still reach the file. Symlinks and hardlinks need separate treatment. Enforce isolation around the running process when that is required. Instructions advise; executable checks can reject matching actions.
Code blocks are teaching excerpts. Keep the surrounding error handling and application requirements.
Save the code excerpts ↓Read the full transcript
Pi is a coding agent that lets an AI model read and change files. Can I change its rules? Yes. Pi runs the tools around the model. That surrounding program is called a harness. An extension adds your own code. Our demo protects menu.txt. We send a simulated write request. The file still says coffee. Nothing has run yet. So where does Pi stop it? This TypeScript extension listens before a tool runs. It checks write requests. For this file, block true stops the write. Pi returns the reason, and menu.txt stays unchanged. A write to notes.txt is allowed. Same rule, different file. Could a shell command still change the menu? Yes. This checks the write tool only. It is not a sandbox. For isolation, also restrict the process. Use instructions for advice, code for checks. The model promised to respect the menu. Great. The file prefers evidence.
