@spences10/pi-nopeek

Secret-safe workflow reminder that steers Pi agents to use nopeek instead of exposing .env values

Packages

Package details

extension

Install @spences10/pi-nopeek from npm and Pi will load the resources declared by the package manifest.

npm repohome report
$ pi install npm:@spences10/pi-nopeek
Package
@spences10/pi-nopeek
Version
0.0.13
Published
May 21, 2026
Downloads
496/mo · 73/wk
Author
spences10
License
MIT
Types
extension
Size
7.8 KB
Dependencies
0 dependencies · 1 peer
Pi manifest JSON
{
  "extensions": [
    "./dist/index.js"
  ],
  "image": "https://raw.githubusercontent.com/spences10/my-pi/main/assets/pi-package-preview.png"
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

@spences10/pi-nopeek

built with Vite+ tested with Vitest npm version license

my-pi package preview

Use secrets in commands without pasting them into the model context. pi-nopeek reminds agents to load .env, cloud tokens, and database URLs through the nopeek CLI so workflows can authenticate while secret values stay hidden.

Installation

pi install npm:@spences10/pi-nopeek

Local development from this monorepo:

pnpm --filter @spences10/pi-nopeek run build
pi install ./packages/pi-nopeek
# or for one run only
pi -e ./packages/pi-nopeek

What it does

The extension injects a system reminder telling the model to use pnpx nopeek ... or npx nopeek ... when it needs credentials from:

  • .env
  • .env.*
  • .tfvars
  • .tfvars.json
  • cloud CLI profiles or service credentials

It adds no slash commands and no custom tools.

Model reminder

The injected reminder tells the model to:

  • prefer pnpx nopeek load .env --only KEY_NAME over reading .env
  • use loaded variables by name in later shell commands
  • use pnpx nopeek list and pnpx nopeek status to inspect key names without values
  • use pnpx nopeek audit to scan for exposed secrets and gitignore coverage
  • avoid printing, echoing, catting, grepping, or pasting secret values into context

Example safe workflow:

pnpx nopeek load .env --only DATABASE_URL
psql "$DATABASE_URL" -c 'select 1'

Use npx instead of pnpx outside pnpm-oriented environments.

Using from a custom harness

import nopeek from '@spences10/pi-nopeek';

// pass `nopeek` as an ExtensionFactory to your Pi runtime

my-pi imports this package directly and enables it as the built-in nopeek reminder.

Development

Package scripts build transitive workspace dependencies first, then run local tools through Vite+ with vp exec.

pnpm --filter @spences10/pi-nopeek run check
pnpm --filter @spences10/pi-nopeek run test
pnpm --filter @spences10/pi-nopeek run build

License

MIT