Project trust

A project can carry its own PiG configuration. That configuration can change the model, the shell command prefix, the system prompt and the code PiG loads, so PiG asks before it reads any of it.

Cloning a repository and starting PiG in it must not run that repository's choices. Trust is the decision that separates the two.

This page is the guide to the decision. Security has the wider safety picture.

What needs trust

PiG asks when the project contains one of these inputs. Most inputs are under .pig/:

A bare .pig directory needs no decision. A project with none of these inputs needs no decision, and PiG does not ask. Your own ~/.agents/skills is global input and never needs trust.

Until you trust a project, PiG uses your global configuration alone.

Context files such as AGENTS.md and CLAUDE.md load whatever the decision is, unless you disable context loading. Treat instructions in a folder as untrusted input even when you decline trust.

A Piglet in .pig/piglets/ is project input too, but PiG selects a Piglet before it can ask. --piglet <name> uses the project's Piglet only when the project has a saved trust decision, defaultProjectTrust is "always", or the run passes --approve. Otherwise it uses your own Piglet of that name, and the trust prompt names the project's Piglet. A bare name is never read as a file in the working directory.

How PiG chooses a decision

PiG checks these sources in order. The first source that answers owns the decision:

1. A command-line --approve or --no-approve.
2. A user-level or command-line extension that handles the project_trust event and returns yes or no.
3. A saved decision for the current directory or its closest parent.
4. The global defaultProjectTrust setting.

PiG asks you once, when a session starts in an untrusted project that has one of the inputs above and no source answered. Use /trust to record the decision for later sessions.

The selector shows the saved decision separately from the current session's trust state. The checkmark stays on the saved choice while you browse. Select Trust parent folder to save trust for the parent and clear the project's override. Saving does not change the current session's trust state. Restart PiG to use the new decision.

Decisions are stored in ~/.pig/agent/trust.json, keyed by the project's canonical path. A path inherits the decision of its nearest stored ancestor, so trusting a directory trusts the repositories inside it.

Decide in advance

Set defaultProjectTrust in settings to answer for every project that has no stored decision:

always gives every repository you open the ability to run its own extensions. Set it only where you control what you clone.

Run without a prompt

Print, JSON and RPC modes cannot show the trust prompt. Without an override, extension or saved decision:

• defaultProjectTrust: "always" loads the protected project inputs.
• defaultProjectTrust: "ask" or "never" skips them.

Pass --approve or --no-approve when an automated run needs an explicit one-time decision.

What trust does not cover

Project trust is not a complete startup boundary. As in Pi, PiG reads the project sessionDir setting while it selects or creates a session, before it resolves trust. Declining trust cannot undo that lookup.

pig status shows the project trust decision and marks the resources that a run ignores because the project is untrusted. Use /trust to see the saved decision and the state of the current session.

Trust does not limit what tool calls can reach. After PiG starts, enabled tools use the operating-system permissions of the PiG process.

Compare with Pi

PiG follows Pi's project-trust rules. The paths and the stored file use .pig and ~/.pig.

Related

• Settings lists the keys a trusted project can set.
• Extensions covers the code a trusted project can load.
• Slash commands lists /trust.