pi-cryptex

Pi extension inspired by fastlane-plugin-cryptex for encrypted project credentials.

Package details

← Back
extension

Install pi-cryptex from npm and Pi will load the resources declared by the package manifest.

npm report
$ pi install npm:pi-cryptex
Package
pi-cryptex
Version
0.1.0
Published
Mar 23, 2026
Downloads
21/mo · 7/wk
Author
hjanuschka
License
unknown
Types
extension
Size
37.3 KB
Dependencies
0 dependencies · 3 peers
Pi manifest JSON
{
  "extensions": [
    "./extensions/pi-cryptex.ts"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

pi-cryptex

Encrypted secrets management for pi.

pi-cryptex gives you a clean split between:

  • project secrets (live with each repo)
  • portable account state (live in your ~/.pi/agent area)

Vaults

Project vault

  • Path: .cryptex/vault.v1.enc
  • Purpose: API keys, tokens, project-specific secrets
  • Main tools: cryptex_vault, cryptex_git_sync
  • Password env var: PI_CRYPTEX_PROJECT_PASSWORD

Account vault

  • Path: ~/.pi/agent/cryptex-account.v1.enc
  • Purpose: carry pi auth and multi-pass state across machines
  • Main tools: cryptex_pi_state, cryptex_account_git_sync
  • Password env var: PI_CRYPTEX_ACCOUNT_PASSWORD

Install

Run directly

pi -e ./extensions/pi-cryptex.ts

Install as package

pi install .

Recommended commands

  • /cryptex-project-password - set or rotate project vault password
  • /cryptex-account-password - set or rotate account vault password
  • /cryptex-info - show vault locations
  • /cryptex-backup-pi [profile] - backup selected ~/.pi/agent files into account vault
  • /cryptex-restore-pi [profile] - restore selected ~/.pi/agent files from account vault

Tools

cryptex_vault

Manage project secrets.

Actions:

  • set
  • set_many
  • get
  • get_many
  • delete
  • list
  • nuke
  • rotate_password

cryptex_git_sync

Sync project vault with git.

Actions:

  • push
  • pull

Notes:

  • push can use current repo if repoUrl is omitted.
  • pull requires repoUrl.

cryptex_pi_state

Backup and restore pi account files in the account vault.

Actions:

  • backup
  • restore

Default backup paths:

  • auth.json
  • multi-pass.json
  • settings.json

Default restore paths:

  • auth.json
  • multi-pass.json

cryptex_account_git_sync

Sync account vault to a dedicated private git repo.

Actions:

  • push
  • pull

Notes:

  • repoUrl is required for both actions.

Demo in this repository

This repo includes an encrypted project vault at:

  • .cryptex/vault.v1.enc

It contains a demo key named testkey.

Example prompt:

Show me testkey from project vault

Security

  • Vault encryption: aes-256-gcm
  • Key derivation: scrypt
  • reveal=true returns plaintext to model context and session history. Use only when needed.
  • Account vault may contain highly sensitive auth material (auth.json). Use a strong account password and private git repo.