Configure Pi guardrails for SSH commands

module/home-manager.nix

@@ -10,6 +10,22 @@
     firecrawlApiKey = "$FIRECRAWL_API_KEY";
     firecrawlFreshScrape = true;
   };
+  home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON {
+    features = {
+      policies = false;
+      permissionGate = true;
+    };
+    permissionGate = {
+      requireConfirmation = true;
+      patterns = [
+        {
+          pattern = "(^|[;&|])\\s*(ssh|scp|sftp)(\\s|$)";
+          description = "SSH connection or file transfer";
+          regex = true;
+        }
+      ];
+    };
+  };
 
   sops = {
     age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt";
@@ -122,6 +138,7 @@
           "npm:pi-web-access@0.15.0"
           "npm:pi-mcp-adapter@2.15.0"
           "npm:pi-subagents@0.37.2"
+          "npm:@aliou/pi-guardrails@0.16.0"
         ];
       };
     };