pi-git-commit

Keeps mutative git operations out of the agent's bash and provides a safe, reviewable commit flow in pi-coding-agent: a bash guard, git_commit and git_amend tools, and /commit, /amend, /stop-commit and /toggle-allow-git commands.

What you get

• Bash git guard. Mutative git commands are blocked in the agent's bash and powershell tools — add, stage, commit, push, pull, merge, rebase, reset, clean, rm, restore, switch, cherry-pick, revert, mv, init, clone, index/object plumbing (read-tree, checkout-index, merge-file, prune-packed, hash-object -w, commit-tree, mktree, index-pack, pack-objects), plus mutative forms of branch (including creation, -u, -f, -c/-C/--copy, -D/-M, --force, -t/--track), tag (including creation), checkout (including whole-tree restores like checkout -- .), stash, submodule, worktree, config, remote, apply, notes, update-ref, gc and more. Read-only commands (status, diff, log, fetch, branch, tag, stash list, ...) stay allowed.
• git_commit tool. The agent stages everything (or, with /commit --staged, commits only the index) and commits with a FIX / IMPROVE / NEW type prefix. The tool stays active for the whole session but refuses to run until /commit opens the flow, and it refuses again once the commit succeeds. The active tool set never changes mid-session, so the provider prompt cache is never invalidated.
• git_amend tool. Same type / message parameters as git_commit. It stages all changes (git add .) and folds them into the last commit while rewriting its message and refreshing its timestamp via git commit --amend --date=now, so work done after the previous commit lands in that commit. Gated like git_commit: it refuses until /amend opens the flow and refuses again once the amend succeeds.
• /commit command. While the agent is idle, stages all changes (/commit --staged skips staging and commits only what is already in the index), shows a collapsed summary of the staged diff (a git diff --stat file list; press ctrl+o or click the message to expand the diff preview), unlocks the git_commit tool, and asks the agent to review the changes and commit via git_commit — never via bash. While the agent is working, /commit queues a visible checkpoint at the current position in pi's message queue instead — it shows up in the pending-message list, so you can see exactly where the commit will happen. When the queued work ahead of it finishes, the checkpoint stages the tree at that moment and turns into the same collapsed review, which is shown to you and sent to the model. You can keep queueing tasks after /commit, and queue several commits in one run — each one stages and reviews at its own position. The full diff reaches the agent only when it fits pi's tool limits (2000 lines / 50KB); larger diffs are left out of the context entirely and the agent gets just the stat file list (capped at 100 lines / 8KB), so a giant change can never blow up the session. Run /stop-commit or press escape at any point to abort the flow; queued checkpoints are neutralized so they commit nothing when reached.
• /amend command. /amend [critique] stages the working tree and shows a collapsed review of the current last commit message, the diff since that commit and your critique when you gave one (press ctrl+o or click to expand). That review is sent to the agent, which fixes the message and refreshes the timestamp with git_amend — never via bash. Without a critique, the agent rephrases the message when there are no changes, and otherwise is told to describe the joint result of the original commit and the newer changes. While the agent is working, /amend queues a visible checkpoint at the current position in pi's message queue and turns into the same review when the queued work ahead of it finishes. Run /stop-commit to abort a pending amend.
• /stop-commit command. Aborts a pending commit or amend flow: closes the flow so git_commit and git_amend refuse to run, cancels a /commit or /amend that is still waiting for queued messages, so nothing is changed, and clears the flow's working message immediately. Queued commit and amend checkpoints are also cancelled: they keep their place in the queue but commit or amend nothing when reached. Pressing escape while a flow is pending or active does the same.
• /toggle-allow-git command. Temporarily allows mutative git commands in bash for the current session. The guard re-arms on the next session.

Quick start

1. Make your changes, then run:

/commit

2. The extension stages the working tree and shows a collapsed summary of the staged diff — press ctrl+o or click the message to expand it. The agent receives the full diff when it fits pi's tool limits (2000 lines / 50KB); when it does not, the diff is omitted entirely and the agent sees only the stat file list (capped at 100 lines / 8KB), with a note pointing at read-only git diff --staged -- <path> for details — so even a 400k-line change stays out of context.

3. The agent commits using the git_commit tool:

{
  "type": "FIX",
  "message": "Correct the off-by-one in the retry loop"
}

4. Changed your mind? Run /stop-commit or press escape to abort the flow before the agent commits.

While the agent is working you can queue commits between tasks: run /commit and it takes the current queue position — it appears in the pending-message list, so you can see where it will run. It runs after everything you queued before it and before everything you queue after it. Run /stop-commit before its turn to cancel it.

To rewrite the last commit, run /amend with an optional critique (/amend <what to change>). The extension stages the tree and shows a review of the current commit message, the diff since that commit and your critique — the same queue position, expand and cancel behavior as /commit, except the agent calls git_amend. Without a critique it rephrases the message when there are no changes, or describes the combined result of the old commit and the new changes.

5. If you need to run mutative git yourself, allow it for the session:

/toggle-allow-git

Installation

pi install npm:pi-git-commit

From a local checkout:

pi install /path/to/pi-git-commit

The git_commit tool

Field	Description
type	FIX (bug fix), IMPROVE (improvement), or NEW (new feature).
message	Commit message in imperative mood, without the type prefix (it is added automatically). A leading type word matching the chosen type is stripped (with :, whitespace, or -/— separators, any casing, repeats included) so the type is never duplicated. Multi-line allowed for detailed changes.

The tool runs git add . followed by git commit -m "<TYPE>: <message>" and reports staging or commit failures as tool errors. When the flow was opened with /commit --staged it skips staging and commits only the index. A leading type word in the message is stripped whenever it repeats the chosen type — with :, whitespace, or -/— separators, at any casing, repeated prefixes included — so the type never ends up duplicated: FIX: Fix: ..., FIX: Fix ..., and fix - ... all become FIX: .... The flow gate is enforced in the tool itself: git_commit is listed for the whole session but refuses to run until you run /commit, and it refuses again once the commit succeeds, so the agent cannot commit at arbitrary points in the conversation. Because the active tool set never changes, pi's system prompt stays identical for the whole session and the provider's prompt cache is never invalidated (changing the active tool set rebuilds the system prompt and drops the cached prefix). If a commit fails, the flow stays open and the agent can retry immediately without re-running /commit. A /commit issued while the agent is streaming queues a visible checkpoint and opens the flow at its turn instead, so several commits can be scheduled in one run.

The git_amend tool

/amend [critique] stages the working tree, then sends the agent a review of the current last commit message, the diff since that commit (the full diff when it fits the 2000 line / 50KB budget, otherwise the capped stat plus an omission note), and your critique when you gave one. Without a critique, the agent is told to rephrase the message when there are no changes, or to fold the newer changes into the last commit and describe the joint result when there are. The review appears in the transcript as a collapsed Amend review card; press ctrl+o or click it to expand the message, the prompt and the diff. A /amend issued while the agent is working queues a visible checkpoint and reviews at that position instead. It instructs the agent to call git_amend with a corrected message. The tool applies the same leading-type stripping and empty-message rejection as git_commit. It stages all changes (git add .) and runs git commit --amend -m "<TYPE>: <message>" --date=now, so changes made after the previous commit are folded into it and the commit timestamp is refreshed to the current time. The flow gate matches git_commit: git_amend is listed for the whole session but refuses to run until you run /amend, and it refuses again once the amend succeeds. If the amend fails, the flow stays open and the agent can retry without re-running /amend.

Amending rewrites the last commit, so on a branch that is already pushed the local branch diverges from its upstream. Pushing stays blocked in bash either way.

The bash guard

The guard intercepts tool_call events for the bash and powershell tools and blocks commands that match mutative git forms. The block list is a conservative superset: anything that can change repository state is blocked, while a curated set of read-only forms is explicitly allowed (for example git fetch, git stash list, git remote -v, git config --get, git apply --check, git checkout -- <file>, git submodule status, git worktree list).

The guard parses the command into segments (pipelines, &&, ||, ;, &, command and process substitution, newlines) and inspects only segments that actually invoke git — including path-qualified invocations (/usr/bin/git), wrapper prefixes with their flags (sudo -u root, nice -n 5, timeout -k 5s 10s), environment-assignment prefixes (VAR=1 git ..., env VAR=1 git ...), control constructs ({ ...; }, !, if, while), and sh -c/su -c wrappers — while skipping git's global options such as -C, -c, --git-dir, and --work-tree and blocking -c alias.* overrides that define a mutative alias. Commands nested more than four wrapper levels deep are blocked outright (fail closed), even when no git command is visible. Git commands mentioned inside strings or heredocs are not blocked. Plain git fetch stays allowed, but git fetch --prune/-p/--prune-tags is blocked. Indirect invocation (aliases, variables, find -exec) cannot be detected reliably and is best-effort; likewise a directory passed to git checkout -- without a trailing slash is indistinguishable from a file, so git checkout -- src (restoring the whole src tree) is not caught.

A blocked command returns:

Mutative git commands are blocked. Ask the user to run /toggle-allow-git to allow them for this session.

Troubleshooting

• The agent refuses to commit. The guard blocks git commit in bash by design. Run /commit and let the agent use the git_commit tool.
• The agent stopped committing. You ran /stop-commit or pressed escape, which aborted the pending flow. Run /commit again to start a new one.
• Prompt cache misses (sudden cost/latency spikes) after /commit. Older versions activated and deactivated the git_commit tool per flow, which rebuilt pi's system prompt and invalidated the provider's cached prompt prefix. Update to this version: the tool set now never changes mid-session.
• "Nothing to commit (empty diff)." There are no staged changes — make edits first, then run /commit again.
• I want to commit only some files. Stage the files yourself (or run /toggle-allow-git and let the agent stage them), then run /commit --staged to review and commit exactly the index.
• I want to rewrite the last commit message only. Run /amend without a critique; an amend review works with no file changes, so only the message is rewritten.
• I need git in bash right now. Run /toggle-allow-git; the guard re-arms automatically on the next session start.

Development

Requires Node.js ≥ 22.19 and npm.

npm install
npm test
npm run typecheck

Credits

• badlogic, pi-coding-agent and the tool/command APIs

License

MIT