@spences10/pi-nopeek

Pi extension that reminds the model to use nopeek for secret-safe environment loading

Package details

extension

Install @spences10/pi-nopeek from npm and Pi will load the resources declared by the package manifest.

$ pi install npm:@spences10/pi-nopeek

Pi manifest JSON

{
  "extensions": [
    "./dist/index.js"
  ]
}

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

Pi extension that reminds the model to use nopeek for secret-safe environment loading.

Maintained in the my-pi Vite+ workspace and tested with Vitest.

pi install npm:@spences10/pi-nopeek

Local development from this monorepo:

pnpm --filter @spences10/pi-nopeek run build
pi install ./packages/pi-nopeek
# or for one run only
pi -e ./packages/pi-nopeek

The extension injects a system reminder telling the model to use pnpx nopeek ... or npx nopeek ... when it needs credentials from:

It adds no slash commands and no custom tools.

The injected reminder tells the model to:

prefer pnpx nopeek load .env --only KEY_NAME over reading .env
use loaded variables by name in later shell commands
use pnpx nopeek list and pnpx nopeek status to inspect key names without values
use pnpx nopeek audit to scan for exposed secrets and gitignore coverage
avoid printing, echoing, catting, grepping, or pasting secret values into context

Example safe workflow:

pnpx nopeek load .env --only DATABASE_URL
psql "$DATABASE_URL" -c 'select 1'

Use npx instead of pnpx outside pnpm-oriented environments.

import nopeek from '@spences10/pi-nopeek';

// pass `nopeek` as an ExtensionFactory to your Pi runtime

my-pi imports this package directly and enables it as the built-in nopeek reminder.

pnpm --filter @spences10/pi-nopeek run check
pnpm --filter @spences10/pi-nopeek run test
pnpm --filter @spences10/pi-nopeek run build

MIT