Correctover CCS runtime security extension for the Pi coding agent — blocks dangerous tool calls before they execute and scans tool outputs for secrets / prompt injection after execution, with a tamper-evident audit trail.

Pi is intentionally minimal (four tools: read/write/edit/bash, YOLO by default). This extension is the safety net.

What it does

Pre-execution guardrails on tool_call
- Blocks curl ... | bash, rm -rf /, dd of=/dev/sd*, mkfs, fork bombs, PowerShell IEX (New-Object Net.WebClient)...
- Blocks reads/writes to .env, .aws/credentials, .ssh/id_rsa, kubeconfig, .pem/.key/.p12, etc.
- Detects SSRF targets in commands: 169.254.169.254, metadata.google.internal, 100.100.100.200, RFC1918 ranges, loopback, IPv6 loopback
- CRITICAL-severity matches also set terminate: true to stop the agent turn
Post-execution scan on tool_result
- Redacts AWS/GitHub/OpenAI/Google/Slack/Stripe/JWT/PEM/PKCS#12/npm keys from tool output so secrets do not flow back into the model context
- Flags prompt-injection patterns ("ignore all previous instructions", "reveal your system prompt", "END OF PROMPT", etc.)
- Records commands that commonly leak secrets (env, cat .env, kubectl config view, aws secretsmanager ...) even when no pattern hits
CCS 7-dimension receipts on every call
- structure, schema, latency, cost, identity, integrity, security
- Each receipt is HMAC-SHA256 signed and appended to ~/.pi/agent/correctover/audit.jsonl (Ed25519 signing on the roadmap)
Pi commands
- /correctover:status — counters + audit file path
- /correctover:recent [n] — show last n signed receipts (default 10)

All checks are pure regex / heuristics — no LLM calls, no network. A single tool_call evaluation completes in well under a millisecond, so it does not add noticeable latency to Pi's agent loop.

Install

pi install npm:pi-correctover-security

Or drop the extension in manually:

mkdir -p ~/.pi/agent/extensions
curl -fsSL https://unpkg.com/pi-correctover-security/src/index.mjs \
  -o ~/.pi/agent/extensions/correctover.mjs
# plus scanner.mjs and audit.mjs in the same directory

Pi loads .mjs/.ts extensions through jiti; no build step required.

Configure

Optional environment variables:

Variable	Default	Purpose
`CORRECTOVER_AUDIT_DIR`	`~/.pi/agent/correctover`	Where `audit.jsonl` is written
`CORRECTOVER_AUDIT_KEY`	a built-in dev key	HMAC signing key — set this in production

To verify a log line:

node -e "
import('pi-correctover-security/src/audit.mjs').then(({AuditLog}) => {
  const a = new AuditLog();
  const line = require('fs').readFileSync(a.file,'utf8').trim().split('\n').pop();
  console.log(a.verifyLine(line) ? 'RECEIPT VALID' : 'TAMPERED');
});
"

How it relates to the CCS standard

The seven-dimension model is defined in IETF Internet-Draft draft-correctover-ccs. This extension implements the Security, Identity, Latency, Cost, Structure, Schema and Integrity dimensions at the Pi hook layer and emits signed receipts in line with the CCS L1 receipt schema.