@spences10/pi-redact 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Scott Spence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# @spences10/pi-redact
+
+[![built with vite+](https://img.shields.io/badge/built%20with-Vite+-646CFF?logo=vite&logoColor=white)](https://viteplus.dev)
+[![tested with vitest](https://img.shields.io/badge/tested%20with-Vitest-6E9F18?logo=vitest&logoColor=white)](https://vitest.dev)
+
+Pi extension that redacts likely secrets from tool output before the
+model sees them.
+
+## Install
+
+```bash
+pi install npm:@spences10/pi-redact
+```
+
+Local development from this monorepo:
+
+```bash
+pnpm --filter @spences10/pi-redact run build
+pi install ./packages/pi-redact
+# or for one run only
+pi -e ./packages/pi-redact
+```
+
+## What it does
+
+`@spences10/pi-redact` listens for Pi `tool_result` events and
+rewrites text content before it is added to model context. It is
+intended as a last-mile safety net for accidental secrets in command
+output, file reads, logs, and config files.
+
+It currently detects and redacts:
+
+- API-key-like fields such as `password`, `secret`, `token`, and
+  `api_key`
+- GitHub classic and fine-grained tokens
+- Tavily, Kagi, Brave, and Firecrawl API keys
+- connection strings with embedded credentials
+- SSH config metadata such as `Host`, `HostName`, `User`,
+  `IdentityFile`, `ProxyJump`, and forwarding directives
+
+Redactions preserve a short prefix where helpful and append a marker
+such as `[REDACTED:GitHub Token]`.
+
+## Commands
+
+### `/redact-stats`
+
+Shows how many values were redacted in the current Pi session.
+
+```text
+/redact-stats
+```
+
+## Example
+
+If a tool returns:
+
+```text
+GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz1234567890
+```
+
+The model receives something like:
+
+```text
+GITH********************[REDACTED:GitHub Token]
+```
+
+## Using from a custom harness
+
+```ts
+import redact from '@spences10/pi-redact';
+
+// pass `redact` as an ExtensionFactory to your Pi runtime
+```
+
+`my-pi` imports this package directly and enables it as the built-in
+`filter-output` extension.
+
+## Limitations
+
+This extension is defensive, not a guarantee. It can miss novel secret
+formats, and broad patterns can occasionally redact benign values. Use
+proper secret hygiene as the primary control:
+
+- do not print secrets unnecessarily
+- avoid reading `.env` files into model context
+- prefer scoped, revocable tokens
+- rotate anything that may have been exposed
+
+## Development
+
+```bash
+pnpm --filter @spences10/pi-redact run check
+pnpm --filter @spences10/pi-redact run test
+pnpm --filter @spences10/pi-redact run build
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import type { ExtensionAPI } from '@mariozechner/pi-coding-agent';
+interface RedactionResult {
+    redacted: string;
+    count: number;
+}
+export declare function looks_like_ssh_config(text: string): boolean;
+export declare function redact_ssh_config_metadata(text: string): RedactionResult;
+export declare function redact_text(text: string, options?: {
+    force_ssh_config?: boolean;
+}): RedactionResult;
+export default function filter_output(pi: ExtensionAPI): Promise<void>;
+export {};

package/dist/index.js

@@ -0,0 +1,177 @@
+// Filter-output extension — redact secrets from tool output
+// Patterns from https://github.com/spences10/nopeek
+const SECRET_PATTERNS = [
+    { name: 'AWS Access Key', pattern: /AKIA[A-Z0-9]{16}/g },
+    { name: 'AWS Temp Access Key', pattern: /ASIA[A-Z0-9]{16}/g },
+    {
+        name: 'AWS Secret Key',
+        pattern: /\b(?:AWS_SECRET_ACCESS_KEY|aws_secret_access_key|secret_access_key|SecretAccessKey)\b\s*[:=]\s*["']?[A-Za-z0-9/+=]{40,}["']?/g,
+    },
+    {
+        name: 'Bearer Token',
+        pattern: /Bearer\s+[a-zA-Z0-9._-]{20,}/g,
+    },
+    {
+        name: 'OpenAI/Anthropic API Key',
+        pattern: /sk-[a-zA-Z0-9._-]{20,}/g,
+    },
+    {
+        name: 'Stripe Live Key',
+        pattern: /sk_live_[a-zA-Z0-9]{20,}/g,
+    },
+    {
+        name: 'Stripe Test Key',
+        pattern: /sk_test_[a-zA-Z0-9]{20,}/g,
+    },
+    {
+        name: 'Hetzner Token',
+        pattern: /(?:HCLOUD_TOKEN|hcloud_token|token)\s*[:=]\s*["']?[a-f0-9]{64}\b/g,
+    },
+    {
+        name: 'Private Key',
+        pattern: /-----BEGIN\s+[\w\s]*PRIVATE\s+KEY-----[\s\S]*?-----END\s+[\w\s]*PRIVATE\s+KEY-----/g,
+    },
+    {
+        name: 'Connection String with Password',
+        pattern: /:\/\/[^:]+:[^@]+@/g,
+    },
+    {
+        name: 'Generic Password Field',
+        pattern: /\b[\w-]*(?:password|passwd|secret|token|api[_-]?key)\b\s*[:=]\s*["']?[A-Za-z0-9._:/+=@!-]{8,}/gi,
+    },
+    {
+        name: 'Generic Secret Phrase',
+        pattern: /\b(?:password|passwd|secret|token|api[_-]?key)\b(?:\s+(?:is|was|seen|value|header))?\s*[:=]?\s+[A-Za-z0-9._:/+=@!-]{8,}/gi,
+    },
+    {
+        name: 'Tavily API Key',
+        pattern: /tvly-[a-zA-Z0-9_-]{20,}/g,
+    },
+    {
+        name: 'Kagi API Key',
+        pattern: /[a-zA-Z0-9_-]{40,}\.[a-zA-Z0-9_-]{40,}/g,
+    },
+    {
+        name: 'Brave API Key',
+        pattern: /BSA[A-Z0-9]{20,}/g,
+    },
+    {
+        name: 'Firecrawl API Key',
+        pattern: /fc-[a-f0-9]{32}/g,
+    },
+    {
+        name: 'GitHub Token',
+        pattern: /gh[pousr]_[a-zA-Z0-9]{36,}/g,
+    },
+    {
+        name: 'GitHub Fine-grained PAT',
+        pattern: /github_pat_[a-zA-Z0-9_]{20,}/g,
+    },
+];
+const SSH_CONFIG_VALUE_DIRECTIVE_PATTERN = /^([ \t]*)(HostName|User|IdentityFile|CertificateFile|ProxyJump|ProxyCommand|LocalForward|RemoteForward|DynamicForward|HostKeyAlias)(\s+)(.+)$/gim;
+const SSH_CONFIG_HOST_PATTERN = /^([ \t]*)(Host)(\s+)(.+)$/gim;
+const SSH_CONFIG_MATCH_PATTERN = /^([ \t]*)(Match)(\s+)(.+)$/gim;
+export function looks_like_ssh_config(text) {
+    const has_scope_line = /^\s*(?:Host|Match)\b/m.test(text);
+    const has_sensitive_directive = /^\s*(?:HostName|User|IdentityFile|CertificateFile|ProxyJump|ProxyCommand|LocalForward|RemoteForward|DynamicForward|HostKeyAlias)\b/im.test(text);
+    return has_scope_line && has_sensitive_directive;
+}
+export function redact_ssh_config_metadata(text) {
+    let count = 0;
+    const redact_directive_value = (match, indent, directive, spacing, value) => {
+        if (value.includes('[REDACTED:'))
+            return match;
+        count++;
+        return `${indent}${directive}${spacing}[REDACTED:SSH ${directive}]`;
+    };
+    let result = text.replace(SSH_CONFIG_VALUE_DIRECTIVE_PATTERN, redact_directive_value);
+    result = result.replace(SSH_CONFIG_HOST_PATTERN, (match, indent, directive, spacing, value) => {
+        const trimmed = value.trim();
+        if (trimmed === '*' || value.includes('[REDACTED:'))
+            return match;
+        count++;
+        return `${indent}${directive}${spacing}[REDACTED:SSH Host]`;
+    });
+    result = result.replace(SSH_CONFIG_MATCH_PATTERN, (match, indent, directive, spacing, value) => {
+        if (value.trim().toLowerCase() === 'all')
+            return match;
+        if (value.includes('[REDACTED:'))
+            return match;
+        count++;
+        return `${indent}${directive}${spacing}[REDACTED:SSH Match]`;
+    });
+    return { redacted: result, count };
+}
+function redact_secret_patterns(text) {
+    let count = 0;
+    let result = text;
+    for (const sp of SECRET_PATTERNS) {
+        sp.pattern.lastIndex = 0;
+        result = result.replace(sp.pattern, (match) => {
+            count++;
+            const prefix = match.slice(0, 4);
+            return `${prefix}${'*'.repeat(Math.min(match.length - 4, 20))}[REDACTED:${sp.name}]`;
+        });
+    }
+    return { redacted: result, count };
+}
+function is_ssh_config_path(path) {
+    if (typeof path !== 'string')
+        return false;
+    const normalized = path.replaceAll('\\', '/').toLowerCase();
+    return /(?:^|\/)(?:\.ssh\/(?:config|config\.d\/.+|conf\.d\/.+)|ssh_config)$/.test(normalized);
+}
+function should_force_ssh_config_redaction(event) {
+    if (event.toolName !== 'read')
+        return false;
+    if (!event.input || typeof event.input !== 'object')
+        return false;
+    return is_ssh_config_path(event.input.path);
+}
+function is_text_content(item) {
+    return item.type === 'text';
+}
+export function redact_text(text, options) {
+    let count = 0;
+    let result = text;
+    if (options?.force_ssh_config || looks_like_ssh_config(result)) {
+        const ssh_redaction = redact_ssh_config_metadata(result);
+        result = ssh_redaction.redacted;
+        count += ssh_redaction.count;
+    }
+    const secret_redaction = redact_secret_patterns(result);
+    result = secret_redaction.redacted;
+    count += secret_redaction.count;
+    return { redacted: result, count };
+}
+export default async function filter_output(pi) {
+    let totalRedacted = 0;
+    pi.on('tool_result', async (event) => {
+        if (!event.content)
+            return;
+        const force_ssh_config = should_force_ssh_config_redaction(event);
+        let modified = false;
+        const newContent = event.content.map((item) => {
+            if (!is_text_content(item) || !item.text)
+                return item;
+            const { redacted, count } = redact_text(item.text, {
+                force_ssh_config,
+            });
+            if (count > 0) {
+                modified = true;
+                totalRedacted += count;
+            }
+            return { ...item, text: redacted };
+        });
+        if (modified) {
+            return { content: newContent };
+        }
+    });
+    pi.registerCommand('redact-stats', {
+        description: 'Show how many secrets have been redacted',
+        handler: async (_args, ctx) => {
+            ctx.ui.notify(`Secrets redacted this session: ${totalRedacted}`);
+        },
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,oDAAoD;AAepD,MAAM,eAAe,GAAoB;IACxC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IAC7D;QACC,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACN,+HAA+H;KAChI;IACD;QACC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,+BAA+B;KACxC;IACD;QACC,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,yBAAyB;KAClC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2BAA2B;KACpC;IACD;QACC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2BAA2B;KACpC;IACD;QACC,IAAI,EAAE,eAAe;QACrB,OAAO,EACN,mEAAmE;KACpE;IACD;QACC,IAAI,EAAE,aAAa;QACnB,OAAO,EACN,qFAAqF;KACtF;IACD;QACC,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,oBAAoB;KAC7B;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EACN,iGAAiG;KAClG;IACD;QACC,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACN,2HAA2H;KAC5H;IACD;QACC,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,0BAA0B;KACnC;IACD;QACC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,yCAAyC;KAClD;IACD;QACC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,kBAAkB;KAC3B;IACD;QACC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6BAA6B;KACtC;IACD;QACC,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,+BAA+B;KACxC;CACD,CAAC;AAEF,MAAM,kCAAkC,GACvC,kJAAkJ,CAAC;AACpJ,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAC/D,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAEjE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IACjD,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,uBAAuB,GAC5B,sIAAsI,CAAC,IAAI,CAC1I,IAAI,CACJ,CAAC;IAEH,OAAO,cAAc,IAAI,uBAAuB,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,IAAY;IAEZ,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,sBAAsB,GAAG,CAC9B,KAAa,EACb,MAAc,EACd,SAAiB,EACjB,OAAe,EACf,KAAa,EACJ,EAAE;QACX,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,iBAAiB,SAAS,GAAG,CAAC;IACrE,CAAC,CAAC;IAEF,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CACxB,kCAAkC,EAClC,sBAAsB,CACtB,CAAC;IAEF,MAAM,GAAG,MAAM,CAAC,OAAO,CACtB,uBAAuB,EACvB,CACC,KAAa,EACb,MAAc,EACd,SAAiB,EACjB,OAAe,EACf,KAAa,EACZ,EAAE;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClD,OAAO,KAAK,CAAC;QACd,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,qBAAqB,CAAC;IAC7D,CAAC,CACD,CAAC;IAEF,MAAM,GAAG,MAAM,CAAC,OAAO,CACtB,wBAAwB,EACxB,CACC,KAAa,EACb,MAAc,EACd,SAAiB,EACjB,OAAe,EACf,KAAa,EACZ,EAAE;QACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,KAAK,EAAE,CAAC;QACR,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,sBAAsB,CAAC;IAC9D,CAAC,CACD,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QAClC,EAAE,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7C,KAAK,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,IAAI,GAAG,CAAC;QACtF,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,qEAAqE,CAAC,IAAI,CAChF,UAAU,CACV,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,KAG1C;IACA,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,kBAAkB,CAAE,KAAK,CAAC,KAA4B,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CACvB,IAAgC;IAEhC,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,IAAY,EACZ,OAAwC;IAExC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,IAAI,OAAO,EAAE,gBAAgB,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;QAChC,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IACnC,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAAC;IAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,EAAgB;IAC3D,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO;QAE3B,MAAM,gBAAgB,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;gBAClD,gBAAgB;aAChB,CAAC,CAAC;YACH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,aAAa,IAAI,KAAK,CAAC;YACxB,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAwB,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ,kCAAkC,aAAa,EAAE,CACjD,CAAC;QACH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@spences10/pi-redact",
+  "version": "0.0.1",
+  "description": "Pi extension that redacts secrets from tool output before the model sees them",
+  "keywords": [
+    "pi",
+    "pi-package",
+    "redaction",
+    "secrets"
+  ],
+  "license": "MIT",
+  "author": "Scott Spence <me@scottspence.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/spences10/my-pi.git",
+    "directory": "packages/pi-redact"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@mariozechner/pi-ai": "^0.70.2",
+    "@mariozechner/pi-coding-agent": "^0.70.2"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.5"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ]
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run"
+  }
+}