Deterministic Bash permission gate for OpenCode and Pi

Auto Mode Gate applies one host-neutral policy before a built-in Bash tool call executes. Version 0.3.0 stores policy under each host and migrates shared 0.2.0 files without overwriting them. Version 0.2.0 added an opt-in Pi judge for a narrow eligible Git request after deterministic analysis. Version 0.1.0 remains deterministic-only.

Not an operating-system sandbox

Auto Mode Gate does not replace native OpenCode or Pi permissions. A separately launched child host must load its own adapter, and coverage is limited to the documented hook paths.

How a decision works

1. The host adapter normalizes the Bash call and its available evidence.
2. The shared core applies deterministic rules.
3. A safe, exact trusted-path read may continue; dangerous and ineligible input blocks.
4. An eligible Pi action reaches one isolated judge call only when global configuration and the current session enable it.

Result	Effect
allow-final	Continue without a model call.
deny-final	Block without a model call.
unresolved-ineligible	Block without a model call.
unresolved-eligible	Pi may ask once; OpenCode blocks as unavailable.

Pi judge in version 0.2.0

Pi sends only closed enums for a configured Git diff, log, show, or status candidate. It sends no command text, values, paths, URLs, secrets, history, host context, or IDs. Deterministic decisions, off, and shadow make zero model calls. Cancellation, deadline, malformed output, tool calls, errors, and unavailable models block. After an enforced allowance, the adapter freezes the reviewed argument object before another pre-tool handler can change it.

Choose a path

• Install the package for OpenCode or Pi.
• Configure the gate with host-owned global and project policy.
• Migrate shared 0.2.0 configuration without overwriting either host.
• Understand the decision rules before trusting a path.
• Check validated baselines before claiming compatibility.

What this project protects

The gate is deliberately narrow. The shared core does not execute commands or contact a network service. An authorized active Pi session may use the host’s configured model transport for one eligible request. The project does not persist command text and records only sanitized decision metadata when logging is configured.