@spences10/pi-redact

Prevent accidental secret exposure before tool output reaches the model. pi-redact scans command results for likely tokens, keys, and credentials, replacing them with safe placeholders while preserving enough context to debug.

Installation

pi install npm:@spences10/pi-redact

Local development from this monorepo:

pnpm --filter @spences10/pi-redact run build
pi install ./packages/pi-redact
# or for one run only
pi -e ./packages/pi-redact

What it does

@spences10/pi-redact listens for Pi tool_result events and rewrites text content before it is added to model context. It is intended as a last-mile safety net for accidental secrets in command output, file reads, logs, and config files.

It currently detects and redacts:

• quoted JSON and unquoted environment/config fields with sensitive names such as password, client_secret, access_token, and api_key, including values containing shell punctuation
• GitHub, GitLab, Slack, npm, Google, SendGrid, JWT, and common vendor-prefixed tokens
• AWS credentials, bearer tokens, and connection strings with embedded credentials
• private-key blocks and partial private-key reads; sequential read chunks for the same path remain redacted after a private-key header
• SSH config metadata such as Host, HostName, User, IdentityFile, ProxyJump, and forwarding directives

Redactions preserve a short prefix where helpful and append a marker such as [REDACTED:GitHub Token].

Commands

/redact-stats

Shows how many values were redacted in the current Pi session.

/redact-stats

Example

If a tool returns:

GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz1234567890

The model receives something like:

GITH********************[REDACTED:GitHub Token]

Using from a custom harness

import redact from '@spences10/pi-redact';

// pass `redact` as an ExtensionFactory to your Pi runtime

my-pi imports this package directly and enables it as the built-in filter-output extension.

Limitations

This extension is defensive, not a guarantee. It can miss novel secret formats, dynamically assembled values, and chunks that begin midway through a secret without prior context. It intentionally does not blanket-redact unlabelled base64, compressed, encrypted, or other high-entropy output because source archives, hashes, and build artifacts commonly have the same shape. Broad patterns can also occasionally redact benign values.

Use proper secret hygiene as the primary control:

• do not print or encode secrets unnecessarily
• avoid reading .env files into model context; prefer nopeek for secret-safe environment loading
• prefer scoped, revocable tokens
• rotate anything that may have been exposed

Development

Package scripts build transitive workspace dependencies first, then run local tools through Vite+ with vp exec.

pnpm --filter @spences10/pi-redact run check
pnpm --filter @spences10/pi-redact run test
pnpm --filter @spences10/pi-redact run build

License

MIT