Leash – A safety hook blocking dangerous commands

[melihmucuk]

Hey everyone! I built a security hook that sandboxes Pi's file system access. It blocks dangerous commands outside your project directory and prevents destructive git operations.

What it does:

• Blocks rm, mv, cp, chmod etc. outside working directory
• Blocks git reset --hard, push --force, clean -f
• Resolves symlinks to prevent directory escapes
• Analyzes command chains (&&, ||, ;, |)
• Near-zero latency (~20µs per tool call since it's in-process)

Setup is simple. Clone the repo and add to ~/.pi/agent/settings.json:

{
  hooks: [~/leash/dist/pi/leash.js]
}

It's open source and also supports Claude Code, OpenCode, and Factory Droid.

Repo: https://github.com/melihmucuk/leash

Would love feedback or contributions!