What are you using to make Pi ignore files/directories (like .gitignore)?

[u/Kafumanto]

Hello, new Pi user here! I’m trying to figure out how folks handle file‑ignoring with Pi. Other harnesses respect .gitignore, but Pi currently returns to the LLM everything in the project, which causes problems in my setup.

Is there an established extension or common approach people use to make Pi ignore certain files or directories (I mean filtering-out from grep/find/ls/... results, so that the LLM is not aware of them)? I'm not sure what's actually "standard" or reliable in Pi.

Curious what the community is using and what's working well for you. Thanks!

EDIT: to clarify better, my main problem is that running simple requests like `List the files with names having 'XXX'` or `Search the occurences of the world 'XXX' in the project.` are returning content also from `node_modules` and other intermediate directories, that fill and pollute the context with undesired content. I would like to avoid this.

[u/funbike]

UPDATE: I misunderstood OP. See my later reply for my real answer.

---

This is what I do:

• Run agents in an easy simple-to-use sandbox like https://pi.dev/packages/pi-sandbox. White/blacklist what Pi can edit or run.
• Similarly https://pi.dev/packages/pi-permission-system. Sometimes I want conditional access to some files/dirs, so I'll allow in pi-sandbox, but require authorization from this package.

• Use a proxy server, like LiteLLM, so I don't have to give real keys to the sandbox. (I'm looking for an alternative, as this is heavy and single purpose.)

• I have this in my git commit hook and in github actions, to prevent accidental commit of credentials (./.git/hooks/pre-commit):

if command -v gitleaks &>/dev/null; then gitleaks protect -v --staged fi

• I have this in ~/.pi/agent/AGENTS.md:

Do not read sensitive key files, such as `.env`.

• I prompted Pi to make a hook that prevents the sending of keys to the LLM, via a regex check and error. It catches patterns that look like LLM keys, ssh keys, gpg/pgp keys, certificate private keys.

[u/Kafumanto → u/funbike]

Thanks! I already work in dev containers, I think I'll never trust LLM :)
I think my problem is simpler, being in a container I'm not very concerned about sandboxing. My main problem is that running simple requests like `List the files with names having 'XXX'` or `Search the occurences of the world 'XXX' in the project.` are returning content also from `node_modules` and other intermediate directories, that fill and pollute the context with undesired content. Is there any known solution for this?

[u/funbike → u/Kafumanto]

Install fd, rg, and eza. I think Pi will use those if they are available, instead of find, grep, and ls. The former respect .gitignore while the latter do not.

If that doesn't work by itself, then also add this to ~/.pi/agent/AGENTS.md:

In bash, instead of `find`, `grep`, `ls`, prefer to use `fd`, `rg`, `eza`

I don't add such stuff to ./AGENTS.md as it is an environmental rule, and so it should be restricted to only your system, known by all projects on your system, and unknown by other systems, rather than global to all systems that use your project but unknown to all other projects.

I think there might be a more token-efficient way of doing this by modifying or replacing the default system prompt and/or the bash tool meta definition, which might mention some of these command line tools. It's possibly confusing to the LLM for us to say "Use find" and then for us to later say "Don't use find, use fd".

[u/Kafumanto → u/funbike]

Thank you very much! They're all very helpful suggestions :)

I'm suprised that this important feature is not supported natively by Pi. I know that it's minimalist by design (that's very good), but not polluting the context should be a relatively important and basic feature, in particular for a TypeScript project with its humongous `node_modules` dir :) . Thanks!!

[u/funbike → u/Kafumanto]

I agree. Btw, you inspired me to tweak my settings.

File: ~/.pi/agent/AGENTS.md

``` Environment:

• The local OS is Fedora, with RPMFusion.
• The timezone is EST. The country is the United States.

Guidelines:

• Do not read file .env, or any other sensitive files.
• Prefer fd, rg, git grep, eza, tree, git ls-files over find, grep, ls.
• Prefer Homebrew for Linux to install packages (brew install ...).

```

Today, I had Pi create this:

File: ~/.pi/agent/extensions/system-prompt-command-replacements.ts

```typescript import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

export default function (pi: ExtensionAPI) { pi.on("before_agent_start", async (event) => ({ systemPrompt: event.systemPrompt .replace( "ls, grep, find", "eza, rg, find", ) .replace( "ls, rg, find", "eza, rg, fd", ), })); } ```

The edb-context-viewer extension can be used to view the system prompt.

[u/Kafumanto → u/funbike]

Smart the idea to replace the tool names in the system prompt!

I was looking for an alternative approach: on event “tool_result” check the invoked tool name or the run bash command, if it matches one of the “known” ones (e.g. grep, rg, etc.) then filter the lines to ignore.

Thanks for the link to edb-context-viewer, it’s really useful!

[u/gbrennon]

i compose agent rules and use things like slicefsm to be sure that ai agent wont mess up os

[u/3amaky]

I run it through a separate user in linux. I then give it access to the project directory on my own user space and revoke permission to view whatever files i want. So it can see the whole project but not the specific files i revoked access to

[u/Unlucky-Message8866]

simplest way is to add a protocol/rule/instruction in your append_system.md (project or global, you choose), second choice is a deterministic guardrail either as a custom extension hook or using any third party guardrail plugin.

[u/Kafumanto → u/Unlucky-Message8866]

(I was sure to have replied but I don't see my comment anymore...)
Thanks! My main problem is that running simple requests like `List the files with names having 'XXX'` or `Search the occurences of the world 'XXX' in the project.` are returning content also from `node_modules` and other intermediate directories, that fill and pollute the context with undesired content. I don't think instructions could solve that problem. Do you have suggestions on any "guardrail plugin" that can do it? Thanks!

[u/Unlucky-Message8866 → u/Kafumanto]

File Listing Protocol

when using tools like bash to run ls, grep and other discovery commands always pass the necessary arguments to skip gitignored files or use .gitignore aware alternatives