Transparent Hooks Beat Explicit Orchestration: Inside My Pi Dev Harness

How a Pi extension runs a full agentic SDLC through hooks the agent never sees: shift-left gates by phase, TDD with isolated test authoring, a dangerous-command gate, plan mode and git worktrees.

This post is part of my Pi workflow series, which starts with the overall picture of how I run my working day inside Pi. This part covers the extensions that make agent work safe and repeatable.

The best guardrails are the ones the agent doesn’t know about: the harness runs the checks, so the agent never has to remember to.

The dangerous command gate

Every bash tool call passes through a risk classifier before execution. Commands are matched against pattern rules and sorted into two tiers:

• High risk (🔴): rm -rf, sudo, mkfs, system control, always prompts, blocked entirely in non-interactive mode.
• Medium risk (🟡): chmod, git push --force, docker rm, package uninstalls: prompts interactively, allowed with warning otherwise.

When a dangerous command is caught, an interactive prompt lets me allow once, allow the whole category for the session, or block. The gate also injects system-prompt guidance nudging the LLM towards safer alternatives: trash over rm -rf, dry-run flags before destructive operations…