@spences10/pi-redact

Prevent accidental secret exposure before tool output reaches the model. pi-redact scans command results for likely tokens, keys, and credentials, replacing them with safe placeholders while preserving enough context to debug.

Installation

pi install npm:@spences10/pi-redact

Local development from this monorepo:

pnpm --filter @spences10/pi-redact run build
pi install ./packages/pi-redact
# or for one run only
pi -e ./packages/pi-redact

What it does

@spences10/pi-redact filters Pi tool_result content and direct ! shell output before it is added to model context. It is intended as a last-mile safety net for accidental secrets in command output, file reads, logs, and config files.

It currently detects and redacts:

• quoted JSON and unquoted environment/config fields with sensitive names such as password, client_secret, access_token, and api_key, including lowercase prefixed TOML assignments and values containing shell punctuation
• GitHub, GitLab, Slack, npm, Google, SendGrid, JWT, and common vendor-prefixed tokens
• AWS credentials, bearer tokens, and connection strings with embedded credentials
• private-key blocks and partial private-key reads; sequential read chunks for the same path remain redacted after a private-key header
• SSH config metadata such as Host, HostName, User, IdentityFile, ProxyJump, and forwarding directives

Redactions preserve a short prefix where helpful and append a marker such as [REDACTED:GitHub Token].

Commands

/redact-stats

Shows how many values were redacted in the current Pi session.

/redact-stats

Example

If a tool returns:

GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz1234567890

The model receives something like:

GITH********************[REDACTED:GitHub Token]

Using from a custom harness

import redact from '@spences10/pi-redact';

// pass `redact` as an ExtensionFactory to your Pi runtime

my-pi imports this package directly and enables it as the built-in filter-output extension.

Limitations

This extension is defensive, not a guarantee. It can miss novel secret formats, dynamically assembled values, and chunks that begin midway through a secret without prior context. It intentionally does not blanket-redact unlabelled base64, compressed, encrypted, or other high-entropy output because source archives, hashes, and build artifacts commonly have the same shape. Broad patterns can also occasionally redact benign values. Direct ! output is filtered from the transient model context, but Pi currently persists the original shell output in its session transcript before context filters run.

Use proper secret hygiene as the primary control:

• do not print or encode secrets unnecessarily
• avoid reading .env files into model context; prefer nopeek for secret-safe environment loading
• prefer scoped, revocable tokens
• rotate anything that may have been exposed

Development

Package scripts build transitive workspace dependencies first, then run local tools through Vite+ with vp exec.

pnpm --filter @spences10/pi-redact run check
pnpm --filter @spences10/pi-redact run test
pnpm --filter @spences10/pi-redact run build

License

MIT