Containers already provide isolation, so the confirmation prompts
add friction without security benefit. Checks /.dockerenv,
/run/.containerenv, and the container/CONTAINER env vars.

Assisted-by: Claude Opus 4.6 via pi

diff --git a/ai/pi/extensions/permission-gate.ts b/ai/pi/extensions/permission-gate.ts
index ecfe279a..2751e4dc 100644
--- a/ai/pi/extensions/permission-gate.ts
+++ b/ai/pi/extensions/permission-gate.ts
@@ -316,7 +316,16 @@ function isAllowed(toolName: string, input: Record<string, unknown>, ctx: Extens
 // Extension entry point
 // ---------------------------------------------------------------------------
 
+function isContainer(): boolean {
+  try { fs.accessSync("/.dockerenv"); return true; } catch {}
+  try { fs.accessSync("/run/.containerenv"); return true; } catch {}
+  if (process.env.container || process.env.CONTAINER) return true;
+  return false;
+}
+
 export default function(pi: ExtensionAPI) {
+  if (isContainer()) return;
+
   pi.on("session_start", async (_event, ctx) => {
     // Reset state each session
     allowedCommands = BASE_COMMANDS;