See, control, and price every tool call pi makes — bash, read, write, edit, and any custom tool — from one dashboard. pi ships no permission system by design; this native extension adds one, in one command.
## TL;DR The installer detects pi, drops the extension at `~/.pi/agent/extensions/acp.ts`, and opens your browser once to provision a workspace and save the key to `~/.acp/credentials`. Restart pi — every tool call is governed from the next session.MIT-licensed, zero dependencies, one readable file — read it before you run it.
## Why an extension (and why it's the whole story) pi is built minimal-core: four tools, no built-in approval prompts, no allowlist, no sandbox — [and its docs say so plainly](/controls/pi). What it does have is a typed extension pipeline that **every** tool dispatch flows through. Because pi has no MCP layer and no second tool path, one extension on that pipeline governs everything the agent does. There's nothing to supplement — unlike Codex (hooks cover shell, MCP covers the rest) or Cursor (some built-ins don't emit). One file, complete coverage. ## How it works pi dispatches every tool through two typed events; the extension registers on both: | pi event | ACP endpoint | What happens | |---|---|---| | `tool_call` | `POST /govern/tool-use` | Server returns `allow` / `ask` / `deny`. Deny blocks the call with the reason in the transcript; ask prompts you (attended) or denies (unattended). | | `tool_result` | `POST /govern/tool-output` | Output scanning. A server block turns the result into corrective feedback; a redact replaces the content the model reads (PII, secrets, injected instructions). | Everything pi runs — `bash`, `read`, `write`, `edit`, subagent and custom tools — flows through those two events. Coverage details on the [pi controls reference](/controls/pi) and the [cross-harness matrix](/coverage). ## Approvals and the empty chair pi tells the extension whether a human is present via `ctx.hasUI`: - **Attended** (interactive TUI): an `ask` decision prompts you inline through pi's own confirm dialog — approve and the call runs, decline and it's blocked. - **Unattended** (`pi -p`, JSON mode): an `ask` becomes a **deny**, with the request surfaced in the console for later review. No timeout guessing, no silent auto-yes — an agent nobody is watching cannot self-approve. This is the [empty-chair posture](/blog/interactive-vs-autonomous-the-empty-chair-test), and pi states the condition exactly. ## Failure posture The standard never-brick contract: - **Attended sessions fail open, loudly.** Gateway unreachable → the call proceeds, a `[ACP] ⚠ UNGOVERNED` warning shows, and a line lands in `~/.acp/lapse.log`. One transport retry precedes the fail posture (the slow answers are cold starts). - **Unattended runs fail closed.** Nobody is watching, so the block is the safety net. - Policy denies are unaffected — this posture only covers the inability to *ask* the policy. ## What gets installed and where | Path | Purpose | |---|---| | `~/.pi/agent/extensions/acp.ts` | The extension (global scope — loads without a project-trust prompt) | | `~/.acp/credentials` | Bearer token from browser OAuth (`chmod 600`) | The global path matters: extensions there govern before any repository is opened, whereas project-local `.pi/extensions/` entries load only after you trust the project. Credential rotation is a one-file overwrite — no reinstall. Uninstall: delete `acp.ts`.