Skip to content
Auto Mode GateAuto Mode Gate
Auto Mode Gate

Control Bash permissions before execution

Deterministic policy first. One isolated Pi judge call only for eligible uncertainty.
Install 0.4.3Use Pi controls

Current release: 0.4.3MIT

Auto Mode Gate reviews built-in Bash tool calls before OpenCode or Pi executes them. It resolves safe and dangerous cases without a model, then reserves the configured Pi judge for a narrow set of eligible Git requests.

What the gate does

Section titled “What the gate does”

Deterministic first

Exact rules decide known-safe reads, dangerous commands, and unsupported syntax before any model-assisted decision.

Fail closed

Missing evidence, malformed configuration, timeout, invalid output, or unavailable transport blocks the call.

Host-owned policy

OpenCode and Pi keep separate global and project policy paths, with safe migration from the shared 0.2.0 files.

Sanitized by design

Optional logs exclude commands, arguments, prompts, secrets, session IDs, and persistent identifiers.

Follow a decision

Section titled “Follow a decision”
  1. Normalize the call. The host adapter records only the Bash call shape and evidence supplied by the host.
  2. Apply deterministic policy. Safe, dangerous, and ineligible outcomes finish here.
  3. Check judge eligibility. Only configured Git diff, log, show, or status uncertainty can continue.
  4. Ask once or block. An authorized Pi session with effective Auto enabled may make one isolated request. OpenCode and every unavailable or invalid path block.
Result Effect
allow-final Continue without a model call.
deny-final Block without a model call.
unresolved-ineligible Block without a model call.
unresolved-eligible Pi may ask once; OpenCode blocks as unavailable.

A model decision never overrides a deterministic denial. Native host permissions still apply after an Auto Mode Gate allowance.

Pi controls in 0.4.3

Section titled “Pi controls in 0.4.3”

Introduced in 0.4.0 and unchanged in 0.4.3, the controls persist requested Auto state, judge model, thinking, and shortcuts across Pi sessions. Requested and effective state stay separate, so project restrictions, missing model scope, or an unsupported thinking level can disable effective Auto without erasing the user’s choice.

The selected judge model receives closed enums for an eligible action. It receives no command text, values, paths, URLs, secrets, history, working directory, or IDs. Auto Mode Gate does not change Pi’s primary conversation model or thinking level.

Use the Pi judge controls to open the menu, run direct commands, change shortcuts, and inspect blocking reasons.

Start here

Section titled “Start here”
InstallLoad the published package in OpenCode or Pi.
ConfigureCreate host-owned global and project policy.
MigrateCopy valid 0.2.0 policy without overwriting either host.
Verify and operateConfirm discovery, scope, native permissions, and runtime state.
Understand decisionsRead the exact deterministic and judge boundaries.
Validated baselinesCheck the host and Node versions covered by release evidence.

Scope and limits

Section titled “Scope and limits”

The shared core does not execute commands or contact a network service. An authorized Pi session with effective Auto enabled may use the host’s configured model transport for one eligible request. The project records only sanitized decision metadata when logging is configured. Read coverage and boundaries before treating the gate as a security control.