Rebuild the defaults

Module 5 left you able to add capability to Pi: a custom tool, a hook that runs on every turn. It never asked whether you should. /stash re-extracts a saved URL on command, and the custom tool behind it does exactly what you told it to - which is exactly when a less comfortable thought shows up: what’s stopping it from growing into something you didn’t ask for?

Nothing. That’s not a bug you missed - it’s the whole design. Pi ships with no permission-prompt gate at all. No sandbox, no allow/ask/deny list, no confirmation before a bash call. Every tool call that reaches the model runs, full stop. Pi calls this out plainly rather than burying it: the design position is that most permission-prompting is security theater, and that allow-listing individual commands doesn’t scale, so Pi doesn’t bother shipping any of it. That’s a real, considered position, not an oversight, and it’s worth sitting with before you reach for the fix. But stash is no longer a toy repo you’re poking at. It’s holding real state now: a SQLite database with every article you’ve saved, and a .env file carrying the tokens the fetch worker and search index need to do their jobs.

So this module attacks a new slice of the enemy that’s run through every module so far: the finite context window, and the fact that Pi’s defaults spend it for you without asking. Here the spend isn’t tokens - it’s turns. Call it the turn tax: every gate you bolt back on is free the moment it’s idle, and costs you a real turn the moment it fires. Four times this module you’ll build something Pi left out (or, once, replace something it shipped), pay the turn tax to see what it actually costs, and decide - not guess - whether the bill was worth it.

Four stops, same running repo, same two questions at each one: what does this gate cost when it fires, and what does it buy you back?

• Permissions - a damage-control extension that reads a rule file and gates every tool_call: some violations stop you outright, some let the agent adapt and keep moving.
• Task discipline - Pi has no to-do list, on the view that structured task tracking confuses models more than it helps. You’ll build a stricter version anyway: a gate that blocks every other tool until exactly one task is in progress, with state rebuilt from session history instead of a side file.
• Plan mode - Pi has no dedicated planning posture at all. In its place: a PLAN.md habit that persists across sessions and stays fully readable, on the same hook you’ll recognize from the permission gate.
• Statusline - Pi’s default footer already shows model, context percentage, and cost; you’ll replace it with one that also tracks a live tool tally, built from the same footer contract every other statusline extension in the wild reuses.

None of this makes Pi into Claude Code or Codex with a different paint job. It makes the guardrails a set of files you own, can diff, and can turn off the instant they get in your way. By the end you’ll have a real entry in the “what it costs” column for each one, measured in turns instead of tokens, and a verdict on which of the four actually earned its keep.

Start with the sharpest of the four: stopping the agent from deleting the thing you can’t get back.