my-pi/config/pi-permission-policy.jsonc

{
  "debugLog": true,
  "permissionReviewLog": true,
  "yoloMode": false,
  "doublePressToConfirm": true,

  // AutoReview is the default authority for deterministic review decisions.
  //
  // The reviewer is a conversational model asked to judge one planned action
  // under a bundled security policy. With no provider/model pair it follows
  // the session's current model, so review quality tracks whatever you run.
  // It answers by calling `approve` or `reject`; a reject — and every failure
  // (timeout, provider error, malformed verdict) — defers to the human
  // permission prompt with the model's reason shown. Approvals are cached
  // within one user message, so the same ask does not pay for a second review.
  //
  // To pin a dedicated review model instead, set BOTH "provider" and "model";
  // exactly one set is a misconfiguration and also defers to the human.
  // "reasoning" defaults to "low" and only applies to reasoning-capable models.
  "authorizerChain": ["auto-review"],
  "autoReview": {
    "enabled": true
  },

  "shellTools": {
    "ssh_bash": {
      "commandArgument": "command",
      "decisionFloor": "ask"
    }
  },

  "permission": {
    // Unknown tools are reviewed instead of silently allowed.
    "*": "ask",
    "read": "allow",
    "write": "allow",
    "edit": "allow",
    "grep": "allow",
    "find": "allow",
    "multi_grep": "allow",
    "ls": "allow",
    "codegraph_explore": "allow",
    "lsp_diagnostics": "allow",
    "lsp_definition": "allow",
    "lsp_references": "allow",
    "lsp_hover": "allow",
    "lsp_symbols": "allow",
    "tool_search": "allow",
    "ask_user_question": "allow",
    // Launching, steering or reading a subagent has no side effect itself;
    // every child action is still gated by the permission system and any
    // unresolved "ask" is forwarded to the root session.
    "Agent": "allow",
    "get_subagent_result": "allow",
    "steer_subagent": "allow",
    "web_search": "allow",
    "chrome_snapshot": "allow",
    "chrome_find": "allow",
    "chrome_inspect": "allow",
    "chrome_wait_for": "allow",
    "chrome_screenshot": "allow",
    "chrome_list_console_messages": "allow",
    "chrome_list_network_requests": "allow",
    "chrome_get_network_request": "allow",

    // Hermes memory tools write only to the extension's own agent-directory
    // stores and never touch the workspace, so they stay allowed. memory_search
    // is invoked by the injected memory policy on most turns and must not
    // trigger an AutoReview round trip each time.
    "memory_search": "allow",
    "session_search": "allow",
    "memory_add": "allow",
    "memory_replace": "allow",
    "memory_remove": "allow",
    // Skills skill_manage writes are loaded into every future session, so
    // their creation stays human-reviewed.
    "skill_manage": "ask",
    // pi-compaction's evidence recovery reads only the extension's own segment
    // index and never touches the workspace. It is pinned in Tool Search's
    // alwaysEnabled set, so it must not pay an AutoReview round trip per turn.
    "context_tree_query": "allow",
    // pi-overflow's inspector reads only the extension's own stored output
    // directory (id-validated); pinned in Tool Search's alwaysEnabled set.
    "overflow_query": "allow",
    // A codemode script does nothing by itself: every nested tool call it makes
    // runs through this same gate (Pi emits tool_call with parentToolCallId).
    "codemode": "allow",

    // Model-chosen URLs can exfiltrate data — same reason curl/wget ask.
    "web_fetch": "ask",

    "ssh_connect": "ask",
    "ssh_cd": "ask",
    "ssh_read": "ask",
    "ssh_write": "ask",
    "ssh_edit": "ask",
    "ssh_find": "ask",
    "ssh_grep": "ask",

    "path": {
      "*": "allow",
      ".git/*": "ask"
    },
    "bash": {
      "*": "allow",
      "rg*": "deny",
      "grep*": "deny",
      "find*": "deny",
      "fd*": "deny",
      "git *": "ask",
      "git status*": "allow",
      "git diff*": "allow",
      "git log*": "allow",
      "git show*": "allow",
      "git rev-parse*": "allow",
      "git ls-files*": "allow",
      "git grep*": "deny",
      "git branch": "allow",
      "git branch --show-current*": "allow",
      "git remote -v": "allow",
      "git remote get-url*": "allow",
      "git blame*": "allow",
      "git describe*": "allow",
      "git rev-list*": "allow",
      "git merge-base*": "allow",
      "git ls-tree*": "allow",
      "git cat-file*": "allow",
      "git name-rev*": "allow",
      "git shortlog*": "allow",
      "git stash list*": "allow",
      "git worktree list*": "allow",
      "git tag -l*": "allow",
      "git tag --list*": "allow",
      "git config --get*": "allow",
      "git config --list*": "allow",
      "npm install *": "ask",
      "npm add *": "ask",
      "npm uninstall *": "ask",
      "npm update *": "ask",
      "pnpm install *": "ask",
      "pnpm add *": "ask",
      "pnpm uninstall *": "ask",
      "pnpm update *": "ask",
      "bun install *": "ask",
      "bun add *": "ask",
      "bun uninstall *": "ask",
      "bun update *": "ask",
      "pip install *": "ask",
      "pip3 install *": "ask",
      "brew install *": "ask",
      "brew uninstall *": "ask",
      "rm *": "ask",
      "/bin/rm *": "ask",
      "rmdir *": "ask",
      "/bin/rmdir *": "ask",
      "unlink *": "ask",
      "/usr/bin/unlink *": "ask",
      "mv *": "ask",
      "/bin/mv *": "ask",
      "truncate *": "ask",
      "dd *": "ask",
      "chmod *": "ask",
      "chown *": "ask",
      "sudo *": "ask",
      "su *": "ask",
      "kill *": "ask",
      "pkill *": "ask",
      "diskutil *": "ask",
      "security *": "ask",
      "launchctl *": "ask",
      "osascript *": "ask",
      "open *": "ask",
      "ssh *": "ask",
      "scp *": "ask",
      "sftp *": "ask",
      "rsync *": "ask",
      "curl *": "ask",
      "wget *": "ask",
      "printenv*": "ask"
    },
    "skill": {
      "*": "allow"
    }
  }
}