Governance / Free
pi-gatekeeper
Parses every shell command into a syntax tree, flags risky ones, and blocks the catastrophic ones outright - no override. Not a keyword blocklist: it understands command structure.
What it does.
- AST analysis, not keyword matching - catches obfuscated, aliased, and piped destructive commands.
- Catastrophic commands (rm -rf /, mkfs, dd, fork bombs) always blocked, no override.
- Per-command approval dialog: approve, deny, or allow for this project.
- Auto-deny patterns you can add and remove.
- Governance events emitted on every block and approval.
Put it to work.
Install into an existing Pi setup. Windows users should use WSL2 for the full Bastille-C3 toolset.
Public npm release pending. This package currently returns 404 at the configured npm identifier. The command below is for use after publication. Ask about availability.
Install from npm
pi install npm:@bastilleworks/pi-gatekeeperIn use.
Inside Pi
/gatekeeperReference syntax · replace arguments
/gatekeeper deny <pattern> <description>Reference syntax · replace arguments
/gatekeeper allow <id>A status indicator in the Pi footer shows the current mode. Tab on Approve or Deny to expand the editor and attach a message.
Worth knowing.
- Free and open-source (Apache-2.0). Installs from public npm.
Remove this module
Uninstall this extension
pi uninstall npm:@bastilleworks/pi-gatekeeperRemoving an extension does not cancel your subscription. Manage renewal separately.
On the same ground