cc-safety-net omp extension

Ports cc-safety-net destructive-command blocking into oh-my-pi, routing risk assessment through modelRoles.commit (default: minimax/MiniMax-M2.7-highspeed:high).

What it does

Intercepts every bash tool call before execution. When a command matches a destructive pattern, it is forwarded to the commit model for a three-level risk verdict:

Verdict	Action
HIGH	Block — returns { block: true, reason }
MED	Pass through, log a warning
LOW	Pass through silently

On any error (model not found, no API key, network failure, unexpected exception) the extension fails open — it returns { block: false } and never wedges omp.

Destructive patterns detected

Ported verbatim from cc-safety-net 0.8.2:

• rm -rf / rm -fr / rm -[rR]*-f / rm -f*-[rR]*
• git reset --hard / git reset --merge
• git clean -f
• git push --force (without --force-with-lease)
• git branch -D
• git stash drop / git stash clear
• git checkout -- <path>
• git restore (without --staged)
• find ... -delete
• Interpreter one-liners (python -c, node -e, ruby -e, perl -e) containing any of the above

Install

The extension is already in place at ~/.omp/extensions/cc-safety-net/. omp discovers extensions from ~/.omp/extensions/ automatically on startup.

To install on another machine, clone or copy this directory there:

git clone <repo-url> ~/.omp/extensions/cc-safety-net
cd ~/.omp/extensions/cc-safety-net
bun install   # installs devDependencies for TypeScript compilation

Configuration

The commit model is read from ~/.omp/agent/config.yml:

modelRoles:
  commit: minimax/MiniMax-M2.7-highspeed:high

Change commit to any model registered in your omp installation. The extension falls back to minimax/MiniMax-M2.7-highspeed:high if the setting is not present.

Why fail-open?

A safety extension that can block omp itself is worse than no safety extension. Any transient error (model unavailable, rate-limited, mis-configured) must not prevent legitimate work. The fail-open policy ensures:

1. omp always continues operating
2. The static pattern match still fires (the command was suspicious enough to trigger assessment)
3. The failure is logged via pi.logger.warn for post-hoc review

The fail-open decision is intentional and not configurable in this version.