The Project .pi Directory and Trust

Fri, 02 Oct 2026 09:00:00 +0100

You clone a repository. It contains .pi/extensions/migrate-schema.ts, and migrate-schema.ts calls execSync with a string built from a prompt. Pi asks whether you trust the folder. You are being asked a real question: does “yes” merely acknowledge the repository, or does it allow that extension to load and run with your process permissions?

security.md answers it precisely, and the answer has a wrinkle worth knowing before you answer.

What triggers the prompt

Pi requires a project-trust decision when it finds any of these from the current working directory:

Authority, Isolation, and What Makes an Agent Worth Building

Mon, 05 Oct 2026 09:00:00 +0100

Everything so far has been a mechanism. Tools, extensions, events, sessions, modes, protocols. This chapter is about the one question that turns a set of mechanisms into something you would let near a production repository, and about what you are then able to claim.

Two claims carry the chapter. Capability is not authority: Pi can do almost anything the account that started it can do, and several documented mechanisms bear on whether it should do a particular thing. Those mechanisms matter, but none by itself is a sandbox. And a prohibition on what the agent can reach needs enforcement outside the agent’s ability to override it. That may be an operating-system restriction, a credential with limited scope, or a remote service that independently denies an operation. A prompt, an in-process gate and a tool allowlist can still provide useful controls, but they must not be mistaken for containment of the whole process.

Security on AIBussin — AI applications, systems and books

The Project .pi Directory and Trust

What triggers the prompt

Authority, Isolation, and What Makes an Agent Worth Building