A small extension for Pi
Your agent needs to use a credential.
Its conversation doesn’t need to keep it.
Enter or capture secrets privately. Refer to them by name. Keep known values out of Pi’s tool results.
Transcript hygiene. Not a sandbox or a secret manager. Does not protect secrets from a malicious or prompt-injected model.
See it in action
Read the demo transcript. Recorded with synthetic credentials; no model calls or clipboard writes.
Less exposure, less ceremony
request_secret opens a centered, bordered dialog with a highlighted header and background. One asterisk per character tracks typing and deletion, exposing only the input length locally. The agent receives only a name and availability—not the value. Cancel before submitting.
capture_secret stores a command’s stdout directly in extension memory. Neither stdout nor stderr is returned to the agent, even on failure. Commands and paths are still logged.
Run /secret show NAME directly, or /secret list to browse names with ↑/↓ or J/K. Enter opens the selected secret's masked dialog; D asks to forget it. No AI prompt needed. In the dialog, R reveals/hides and C copies; reveal and copy require Y confirmation. The dialog closes after 30 seconds.
Clipboard managers, history, and sync may retain copied values. The clipboard is not automatically cleared.
secure_exec injects named secrets into child-process environment variables. Output is buffered; exact known values are redacted from stdout and stderr before returning.
Not pattern detection: encoded or transformed values can escape redaction. Other tools’ output is not covered. All stored values are checked; large or numerous secrets can exceed redaction limits. Output is then withheld, with recovery guidance. Check the command's effects before retrying.
An explicit boundary
This is a way to reduce accidental exposure, not a promise that a secret cannot leave your machine.
Read the full security boundaryA malicious model, or one following a prompt injection, can still obtain or leak secrets through its tools. It could write a secret to a file and read it back, send it elsewhere, or transform it to bypass exact-value redaction. pi-secure does not prevent prompt injection or enforce secret isolation. Reveal/copy confirmations do not protect other tool paths. Use external sandboxing and network restrictions where needed, plus short-lived, least-privilege credentials.
Commands can access files, send data, or save credentials. There are no destination or file-access restrictions. Never put literal values in chat or tool arguments; names, reasons, commands, and availability are logged normally.
Terminal input recording, scrollback, screen capture, host extensions, process inspection, debug logs, crash dumps, and the operating system are outside this protection. Revealing a value is not recording-proof.
Values live in extension memory and are forgotten on clear, reload, session start, or shutdown. JavaScript memory is not guaranteed to be zeroized. Clearing does not revoke credentials or erase subprocess copies. Prefer short-lived, least-privilege tokens.
Small by design
Already using Pi? Review the source, install from npm or git, then fully restart Pi. /reload can retain stale helper modules.
Inspect third-party extensions before loading them.