@giuseppe.trisciuoglio/pi-prevent-destructive-commands 1.0.0

package/.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Typecheck & Test (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [22.x, 24.x]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Run tests
+        run: npm test

package/.github/workflows/publish.yml

@@ -0,0 +1,47 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          registry-url: https://registry.npmjs.org
+
+      - name: Verify release tag matches package.json version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Release tag ($GITHUB_REF_NAME) does not match package.json version ($PKG_VERSION)"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Run tests
+        run: npm test
+
+      - name: Publish to npm
+        run: npm publish --access public

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Fixed
+- `cd` within an analyzed command chain (e.g. `cd /; rm etc/passwd`) is now tracked: relative paths in subsequent path-sensitive commands resolve against the effective directory instead of the untouched real cwd, while the *original* cwd remains the safety boundary. `( … )` subshell scoping is respected — a `cd` inside parentheses no longer leaks out. A `cd` to a statically unresolvable target (`cd "$VAR"`, `cd -`) causes subsequent path-sensitive commands to be blocked conservatively.
+- `xargs`/`parallel` delegating to a path-sensitive command (`rm`, `rmdir`, `shred`, ...) with no explicit target token (e.g. `echo x | xargs rm`) is now blocked: the real arguments arrive via stdin at runtime and can't be statically verified. An explicit target is still checked normally against the working directory.
+
+### Added
+- Nx workspace protection: blocks the agent from modifying or deleting existing `package.json`, `tsconfig.json`, `tsconfig.base.json`, `tsconfig.lib.json`, and `tsconfig.spec.json` files anywhere beneath a workspace with `nx.json`. Missing files remain creatable. The guard covers direct file tools, patches, common shell mutations, and package-manager dependency commands.
+- CI GitHub Actions workflow: typecheck and smoke tests on Node.js 22 and 24 for every push/PR to `main`.
+- Publish GitHub Actions workflow: publishes to npm when a GitHub Release is published, after verifying the release tag matches `package.json` and re-running typecheck/tests.
+- End-to-end installation test (`test/e2e-install-test.ts`, `npm run test:e2e`): uses the real `@earendil-works/pi-coding-agent` package to verify manual installation and `pi install` are both discovered and loaded correctly, and that the loaded `tool_call` handler blocks/allows commands as expected. `npm test` now runs the smoke suite and the e2e test.
+
+### Fixed
+- `package.json`'s `pi` manifest declared an `entryPoint` field that pi's extension loader does not read, so the extension was never discovered when manually installed by cloning into `<agentDir>/extensions/prevent-destructive-commands` as documented in the README. Replaced it with the `pi.extensions` array field that pi actually resolves.
+
+### Changed
+- Reorganized source files into `src/` and tests into `test/`.
+- Split `checker.ts` into a slim recursive dispatcher plus per-category rule handlers under `src/rules/` (`git.ts`, `docker.ts`, `aws.ts`, `file-reading.ts`, `path-sensitive.ts`, `path-utils.ts`, `types.ts`). No behavior changes.
+
+## [1.0.0] - 2025-07-16
+
+### Added
+- Initial release of `prevent-destructive-commands` extension for pi.
+- Unconditional hard-block of destructive bash commands before execution.
+- Support for destructive Git operations: `git reset --hard`, `git clean`, `git push --force`, `git branch -D`, `git rebase`, `git filter-branch`, `git filter-repo`, and more.
+- Support for destructive Docker operations: `docker rm`, `docker rmi`, `docker container/volume/image/network rm`, `docker * prune`, `docker compose down -v`, and more.
+- Support for destructive AWS CLI operations: `aws s3 rm`, `aws ec2 terminate-instances`, `aws rds delete-db-instance`, `aws cloudformation delete-stack`, and more (50+ subcommands).
+- Path-sensitive protection for `rm`, `rmdir`, `unlink`, `shred`: blocks targets outside the working directory.
+- Optional sensitive file read protection (`cat`, `grep`, etc. on `.env`, SSH keys, credentials) — disabled by default due to false positives.
+- Recursive analysis through command wrappers: `sudo`, `env`, `timeout`, `nice`, `nohup`, `ionice`, `time`.
+- Recursive analysis through shell invocations: `bash -c "..."`, `sh -c "..."`, etc.
+- Recursive analysis through `find -exec`, `xargs`, `parallel`.
+- Recursive analysis through quoted command wrappers: `watch`, `strace`, `ltrace`.
+- Pipeline and concatenation support: `|`, `&&`, `||`, `;`.
+- Configurable behavior flags in `config.ts`.
+- Comprehensive smoke test suite with 70+ test cases.
+- Full TypeScript support with type definitions.
+
+### Security
+- Hard-block design: the agent receives a reason and must find an alternative.
+- No interactive confirmation — protection works in non-interactive modes (`-p`, JSON, RPC).
+- Maximum nesting depth limit (5) to prevent obfuscation attacks.

package/CONTRIBUTING.md

@@ -0,0 +1,105 @@
+# Contributing to prevent-destructive-commands
+
+Thank you for your interest in contributing! This document provides guidelines for contributing to this project.
+
+## Code of Conduct
+
+Be respectful, constructive, and inclusive in all interactions.
+
+## How to Contribute
+
+### Reporting Issues
+
+- Check if the issue already exists before creating a new one.
+- Provide a clear description, steps to reproduce, and expected vs. actual behavior.
+- Include the command that triggered (or failed to trigger) the block.
+- Mention your pi version and Node.js version.
+
+### Suggesting Enhancements
+
+- Open an issue with the "enhancement" label.
+- Describe the use case and the benefit.
+- If proposing a new blocked command category, explain why it should be considered destructive.
+
+### Pull Requests
+
+1. Fork the repository and create a feature branch.
+2. Make your changes with clear, focused commits.
+3. Run the smoke tests: `npm test` (or `npx tsx test/smoke-test.ts`).
+4. Update the README.md if your change affects user-facing behavior.
+5. Update CHANGELOG.md under the "Unreleased" section.
+6. Submit a pull request with a clear description.
+
+## Development Setup
+
+```bash
+# Clone the repository
+git clone https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands.git
+cd pi-prevent-destructive-commands
+
+# Install dependencies
+npm install
+
+# Run smoke tests
+npm test
+
+# Type check
+npm run typecheck
+```
+
+## Project Structure
+
+```
+prevent-destructive-commands/
+├── src/
+│   ├── index.ts          # Extension entry point (factory + tool_call hook)
+│   ├── config.ts         # Blacklists and behavior flags
+│   ├── tokenizer.ts      # Shell tokenizer (shlex-like)
+│   ├── checker.ts        # Recursive command walker (wrappers/shell/find/xargs)
+│   └── rules/            # Per-category destructive-command handlers
+│       ├── types.ts
+│       ├── path-utils.ts
+│       ├── git.ts
+│       ├── docker.ts
+│       ├── aws.ts
+│       ├── file-reading.ts
+│       └── path-sensitive.ts
+├── test/
+│   ├── smoke-test.ts        # Standalone test suite
+│   └── e2e-install-test.ts  # End-to-end: verifies real installation/discovery by pi
+├── tsconfig.json     # TypeScript configuration
+└── package.json      # Package metadata
+```
+
+## Adding New Blocked Commands
+
+To add a new command category:
+
+1. Add the command patterns to the appropriate set in `src/config.ts`.
+2. Add the checker logic to a new or existing handler in `src/rules/`, following the existing handler pattern (see `src/rules/git.ts` or `src/rules/docker.ts`), and wire it into the dispatch loop in `src/checker.ts`.
+3. Add test cases to `test/smoke-test.ts`.
+4. Update the README.md documentation.
+
+## Style Guide
+
+- Use English for all code comments and documentation.
+- Use 2-space indentation (tabs converted to 2 spaces).
+- Prefer explicit types over implicit ones.
+- Keep functions focused and modular.
+
+## Continuous Integration
+
+Every push and pull request to `main` runs the [CI workflow](.github/workflows/ci.yml), which typechecks and runs the smoke test suite and the end-to-end installation test on Node.js 22 and 24.
+
+## Releasing
+
+Publishing to npm is handled by the [Publish workflow](.github/workflows/publish.yml) and is restricted to maintainers:
+
+1. Bump `version` in `package.json` and move the relevant `CHANGELOG.md` entries from "Unreleased" to a new version section.
+2. Commit and merge the version bump to `main`.
+3. Create a GitHub Release with a tag matching `v<version>` (e.g. `v1.1.0`) for the merged commit.
+4. Publishing the Release triggers the workflow, which verifies the tag matches `package.json`, re-runs typecheck/tests, and publishes to npm through the trusted GitHub Actions publisher.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the MIT License.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Giuseppe Trisciuoglio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,239 @@
+# Prevent Destructive Commands
+
+[![CI](https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands/actions/workflows/ci.yml/badge.svg)](https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands/actions/workflows/ci.yml)
+[![Version](https://img.shields.io/badge/version-1.0.0-blue.svg)](https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+[![pi Extension](https://img.shields.io/badge/pi-extension-purple.svg)](https://pi.dev)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.4-blue.svg)](https://www.typescriptlang.org/)
+
+> **Unconditionally blocks destructive bash commands before execution.** A pi extension that guards your codebase against accidental data loss from `rm`, `git reset --hard`, `docker rm`, `aws delete` operations, and more.
+
+A faithful port of Claude's [`prevent-destructive-commands.py`](https://github.com/giuseppe-trisciuoglio/developer-kit/blob/main/plugins/developer-kit-core/hooks/prevent-destructive-commands.py) hook, adapted for the [pi coding agent](https://pi.dev). Same rule set, same recursive tokenizer — same peace of mind.
+
+---
+
+## Features
+
+- **Hard-block protection** — Dangerous commands are blocked unconditionally. The agent receives a clear reason and must find a safe alternative.
+- **Works in all modes** — Protection is active even in non-interactive sessions (`-p`, JSON, RPC).
+- **Recursive analysis** — Traverses command wrappers, shell invocations, pipelines, and nested commands to catch obfuscated attacks.
+- **Nx configuration guard** — In Nx workspaces, existing `package.json` and TypeScript configuration files are immutable to the agent; missing ones can still be created.
+- **Configurable** — Tune protection levels via simple flags in `src/config.ts`.
+- **Zero dependencies** — Lightweight, fast, and self-contained.
+- **79+ test cases** — Comprehensive smoke test suite validates all blocking rules.
+
+## What Gets Blocked
+
+All rules are defined in [`src/config.ts`](src/config.ts) and can be customized.
+
+| Category | Examples |
+|----------|----------|
+| **Destructive Git** | `git reset --hard`, `git clean`, `git push --force` / `-f` / `--delete`, `git branch -D`, `git tag -d`, `git checkout -f`, `git rebase`, `git filter-branch`, `git filter-repo`, `git reflog expire`, `git update-ref -d` |
+| **Git add/commit** | `git add`, `git commit` *(see `ENABLE_GIT_ADD_COMMIT_BLOCK` flag)* |
+| **rm / path-sensitive** | `rm`, `rmdir`, `shred`, `unlink` targeting paths **outside** the working directory (e.g., `/etc`, `~`, `..`). Targets inside cwd are allowed. |
+| **Destructive Docker** | `docker rm` / `rmi`, `docker container/image/volume/network rm`, `docker * prune`, `docker compose down -v`, `docker compose rm`, `docker context rm`, `docker swarm leave --force` |
+| **Destructive AWS CLI** | `aws s3 rm`, `aws ec2 terminate-instances`, `aws rds delete-db-instance`, `aws cloudformation delete-stack`, and 50+ more subcommands (full list in `src/config.ts`) |
+| **Sensitive file reads** | `cat`, `grep`, etc. on `.env`, SSH keys, `.pem` files — **disabled by default** via `ENABLE_SENSITIVE_FILE_CHECK` *(see Configuration)* |
+| **Existing Nx configuration** | `package.json`, `tsconfig.json`, `tsconfig.base.json`, `tsconfig.lib.json`, and `tsconfig.spec.json` anywhere below a workspace containing `nx.json`. Creating a missing file is allowed; changing or deleting an existing file is blocked. |
+
+### Recursive Analysis
+
+The analyzer traverses common command wrappers and nested structures so a destructive command can't hide:
+
+- **Wrappers**: `sudo`, `env`, `timeout`, `nice`, `nohup`, `ionice`, `time`
+- **Shell invocations**: `bash -c "..."`, `sh -c "..."`, `zsh -c "..."`
+- **Execution delegation**: `find -exec`, `xargs`, `parallel`
+- **Quoted wrappers**: `watch "rm foo"`, `strace "..."`
+- **Pipelines & chains**: `|`, `&&`, `||`, `;`
+
+---
+
+## Installation
+
+### Via pi Marketplace
+
+```bash
+pi install @giuseppetrisciuoglio/pi-prevent-destructive-commands
+```
+
+### Manual Installation
+
+1. Clone this repository into your pi extensions directory:
+
+```bash
+git clone https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands.git \
+  ~/.pi/agent/extensions/prevent-destructive-commands
+```
+
+2. Reload pi to discover the extension:
+
+```bash
+pi /reload
+```
+
+The extension is automatically discovered by pi in all projects.
+
+---
+
+## Configuration
+
+Edit the constants in [`src/config.ts`](src/config.ts) to tune protection:
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `ENABLE_GIT_ADD_COMMIT_BLOCK` | `true` | Blocks `git add` and `git commit`. Set to `false` if you want the agent to create commits autonomously. |
+| `ENABLE_SENSITIVE_FILE_CHECK` | `false` | Blocks reading of sensitive files (`.env`, SSH keys, credentials). Disabled by default due to false positives from substring matching (`config` matches `tsconfig`, `vite.config`; `.env` matches `.environment.ts`). Enable only if needed and consider refining `SENSITIVE_FILE_PATTERNS`. |
+| `MAX_NESTING_DEPTH` | `5` | Maximum command nesting depth before treating as obfuscated. |
+
+After any change, reload the extension:
+
+```bash
+pi /reload
+```
+
+---
+
+## Project Structure
+
+```
+prevent-destructive-commands/
+├── src/
+│   ├── index.ts          # Extension entry point (factory + tool_call hook)
+│   ├── config.ts         # Blacklists and behavior flags — tune protection here
+│   ├── tokenizer.ts      # Shell tokenizer (shlex-like)
+│   ├── checker.ts        # Recursive command walker (wrappers/shell/find/xargs)
+│   ├── migration-guard.ts
+│   ├── nx-guard.ts       # Protects existing Nx package and TypeScript configuration files
+│   └── rules/            # Per-category destructive-command handlers
+│       ├── types.ts          # Shared CheckResult type + helpers
+│       ├── path-utils.ts      # cwd-relative path resolution
+│       ├── git.ts             # git reset --hard, push --force, ...
+│       ├── docker.ts          # docker rm, system prune, ...
+│       ├── aws.ts             # aws s3 rm, ec2 terminate-instances, ...
+│       ├── file-reading.ts    # sensitive file read detection
+│       └── path-sensitive.ts  # rm/rmdir/... outside-cwd detection
+├── test/
+│   ├── smoke-test.ts        # Standalone test suite (79+ cases)
+│   ├── migration-guard-test.ts
+│   ├── nx-guard-test.ts     # Verifies Nx configuration protection and allowed creation
+│   └── e2e-install-test.ts  # End-to-end: verifies real installation/discovery by pi
+├── tsconfig.json     # TypeScript configuration
+├── package.json      # Package metadata for pi marketplace
+└── README.md         # This file
+```
+
+---
+
+## Testing
+
+Run the full test suite (command safety, migration, Nx, and end-to-end checks):
+
+```bash
+npm test
+```
+
+### Smoke tests
+
+Standalone tests for the tokenizer/checker logic (no dependency on pi itself):
+
+```bash
+npm run test:smoke
+npm run test:nx-guard
+
+# Or directly with tsx
+npx tsx test/smoke-test.ts
+
+# Or with jiti
+npx jiti test/smoke-test.ts
+```
+
+### End-to-end installation test
+
+Uses the real `@earendil-works/pi-coding-agent` package to verify the extension actually installs the way the [Installation](#installation) section describes:
+
+- The `pi.extensions` entry in `package.json` resolves to an existing file.
+- Manual installation (cloning into `<agentDir>/extensions/prevent-destructive-commands`) is discovered and loaded by pi's own extension loader.
+- `pi install <path>` records the package and pi can subsequently discover and load it.
+- Once loaded through that real pipeline, the registered `tool_call` handler still blocks/allows commands correctly.
+
+```bash
+npm run test:e2e
+
+# Or directly with tsx
+npx tsx test/e2e-install-test.ts
+```
+
+The test suite covers:
+- All destructive Git operations
+- Existing Nx package and TypeScript configuration protection, including direct tool writes, patches, shell redirection, and package-manager dependency changes
+- Path-sensitive `rm` protection
+- Docker destructive commands
+- AWS CLI destructive subcommands
+- Wrapper traversal (`sudo`, `env`, `timeout`)
+- Shell invocation traversal (`bash -c`)
+- `find -exec` and `xargs` delegation
+- Pipeline and concatenation handling
+- Git global flag parsing (`-C`, `--git-dir`)
+- Edge cases and safe command verification
+
+---
+
+## Known Limitations
+
+As with the original Claude plugin, the analysis is static and therefore cannot cover everything:
+
+| Limitation | Example | Explanation |
+|------------|---------|-------------|
+| **Unknown wrappers** | Custom destructive tools | The extension covers known patterns; unknown wrappers or custom destructive tools are not intercepted. |
+
+Two cases that used to be listed here are now handled:
+
+- **Arguments via stdin/pipe** (`echo x \| xargs rm`) — a path-sensitive command (`rm`, `rmdir`, `shred`, ...) reached through `xargs`/`parallel` with no explicit target token is now blocked: its real targets arrive via stdin at runtime and can't be statically verified, so it's treated as dangerous rather than assumed safe. An explicit target (e.g. `xargs rm ./known-file`) is still checked normally against the working directory.
+- **`cd` in command** (`cd /; rm etc/passwd`) — the analyzer now tracks `cd` within the same command chain (including `( … )` subshell scoping) and resolves subsequent relative paths against that effective directory, while still enforcing the *original* working directory as the safety boundary. `cd /; rm etc/passwd` now correctly resolves to `/etc/passwd` and is blocked. When a `cd` target itself can't be resolved statically (e.g. `cd "$VAR"`, `cd -`), any path-sensitive command that follows is blocked conservatively.
+
+---
+
+## How It Works
+
+When pi attempts to execute a bash command, this extension intercepts the `tool_call` event and:
+
+1. **Tokenizes** the command string using a shlex-like shell tokenizer that respects quotes and escapes.
+2. **Analyzes** the token stream recursively, traversing wrappers, shell invocations, and pipelines.
+3. **Blocks** if any destructive pattern is detected, returning a clear reason to the agent.
+4. **Allows** safe commands to pass through without modification.
+
+The agent never receives an interactive prompt — the block is final and must be handled by finding a safe alternative.
+
+---
+
+## Contributing
+
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+
+Quick start for contributors:
+
+```bash
+git clone https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands.git
+cd pi-prevent-destructive-commands
+npm install
+npm test
+```
+
+---
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md) for version history.
+
+---
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).
+
+---
+
+## Acknowledgments
+
+- Inspired by and ported from Claude's [`prevent-destructive-commands.py`](https://github.com/giuseppe-trisciuoglio/developer-kit/blob/main/plugins/developer-kit-core/hooks/prevent-destructive-commands.py) hook.
+- Built for the [pi coding agent](https://pi.dev) ecosystem.

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@giuseppe.trisciuoglio/pi-prevent-destructive-commands",
+  "version": "1.0.0",
+  "description": "Unconditionally blocks destructive bash commands before execution. A pi extension that guards against rm, git reset --hard, docker rm, aws delete operations, and more.",
+  "keywords": [
+    "pi",
+    "pi-extension",
+    "ai-agent",
+    "safety",
+    "destructive-commands",
+    "bash",
+    "shell",
+    "guard",
+    "security",
+    "rm",
+    "git",
+    "docker",
+    "aws"
+  ],
+  "author": "Giuseppe Trisciuoglio",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands.git"
+  },
+  "bugs": {
+    "url": "https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands/issues"
+  },
+  "homepage": "https://github.com/giuseppe-trisciuoglio/pi-prevent-destructive-commands#readme",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "test": "npm run test:smoke && npm run test:migration-guard && npm run test:nx-guard && npm run test:e2e",
+    "test:smoke": "npx tsx test/smoke-test.ts",
+    "test:e2e": "npx tsx test/e2e-install-test.ts",
+    "test:migration-guard": "npx tsx test/migration-guard-test.ts",
+    "test:nx-guard": "npx tsx test/nx-guard-test.ts",
+    "lint": "tsc --noEmit",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.1.0"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.1.0",
+    "typescript": "^5.4.0",
+    "tsx": "^4.7.0"
+  },
+  "pi": {
+    "name": "prevent-destructive-commands",
+    "displayName": "Prevent Destructive Commands",
+    "description": "Blocks destructive bash commands (rm, git reset, docker rm, AWS delete, etc.) before execution.",
+    "category": "security",
+    "extensions": [
+      "./src/index.ts"
+    ]
+  }
+}