Does Pi come with an auto mode that blocks dangerous actions? It didn't last time I checked, and these measures are critical to protect prod (and your personal files, etc) from a confused agent.

I gave the harness a try and it is refreshing, but the insistence on staying bare bones and not implementing basic functionality natively, together with no vetting process for popular 3rd party modules, made me return to Claude Code.

▲

mpern a day ago | parent | next [-]

I would not trust auto mode in the first place.

Wrap your agent of choice in e.g. docker sandbox, nono.sh, Nvidia OpenShell, microsanbox or any other sandboxing tool and run it without any checks (i.e. "yolo mode", dangerously-skip-permissions etc.)

IMHO it makes the whole category of problems around permission fatigue, trusting the harness (or plugin) authors etc go away.

▲

giladd a day ago | parent [-]

I did that. Customized Pi to run in Bubblewrap, made an action authorization flow, etc. But that's throwing the baby with the bathwater. This gives you a harmless, less capable agent. To get both safety and usefulness, Ant's solution of a fast classifier works really well.

	▲	mpern a day ago \| parent \| next [-]
		For me, its the other way around. Strong sandbox + disabling permission checks gives me maximum capabilities, least annoyance and (relative) peace of mind that any prompt injection, malicious plugin,... won't wreck my shit or leak credentials of any kind
	▲	mark_l_watson a day ago \| parent \| prev [-]
		Using Bubblewrap is pretty good. However, I moved to using Apple Containers with one local file directory mounted; When the container is not running, I do git operations outside the container. This is simple, and although not as convenient as running naked with no isolation, it is light weight and easy.

▲

pkulak a day ago | parent | prev | next [-]

Well yeah, the whole point of pi is that you build it to your workflow. If you dislike the entire point of a project, it’s not for you. I run my agents in a sandbox. When Claude or Codex then double sandbox themselves, it gets really annoying.

▲

owlmusic a day ago | parent | prev | next [-]

I use https://pi.dev/packages/pi-warden with Jev (but can use other Decisions API), it would make sense to combine with pi-permission-system to get the CC two stage "default auto" mode.

▲

21 hours ago | parent | prev | next [-]

[deleted]

▲

czottmann 20 hours ago | parent | prev | next [-]

I wrote pi-automode for exactly that reason. Works well enough for me, YMMV.

https://github.com/czottmann/pi-automode

▲

wmedrano a day ago | parent | prev | next [-]

You'd have to install an extension or write a function that intercepts tool calls.

▲

coldbrewed a day ago | parent | prev | next [-]

gotgenes/pi-permission-system and the ai-guard authorizer can do a lot here, it feels very similar to cc auto mode.

I built a policy authorizer on top of pi-permission-system that looks kinda like nftables that models commands/subcommands/options as read/write and enfores policies depending on if the sub agent is read only or write, which really cuts down on the stupid decisions and nicely complements AI cmd review. Pi shines for making things like that possible.

▲

bermudi a day ago | parent | prev | next [-]

You have time to watch over your agents?

▲

jagrit a day ago | parent | prev | next [-]

like the auto mode classifier? if it doesn't then... that's a risky tradeoff

▲

agentdev001 a day ago | parent | prev | next [-]

Sounds to me like it isnt basic functionality if it all works ;)

▲

JoshTriplett a day ago | parent | prev [-]

> bear bones

*bare

	▲	giladd a day ago \| parent [-]
		ty, edited