$ cat ~/map/motus.md
motus
Redacts exact secret values from pi tool output, blocks the commands and files that print them, and fails closed.
extensions✓ Oct 30
Facts
- repository
- github.com/espadat-studio/motus ↗
- GitHub Stars
- ★ 0
- Forks
- 0
- license
- MIT
- npm / mo
- —
- last push
- Nov 2, 2026
install
pi install npm:@espadat/motus (global, never --local), then move it to the top of packages in ~/.pi/agent/settings.json — pi install appends it last, and handlers run in load order — and create ~/.config/motus/config.toml, because without it every session starts degraded. For Claude Code: npm install --global @espadat/motus and register motus-cc-hook as a PreToolUse hook.## TL;DR
A pi extension that keeps API keys away from the model: secrets load at session start from env, command output, mise, pa or 1Password, each exact value is replaced with a [REDACTED:NAME] marker in tool results, messages, prompts and the provider request, and credential paths and printing commands are blocked. A Claude Code hook adds the blocks; everything fails closed.
## Key points
- $In pi it redacts and blocks: tool results, saved messages, prompts, ! shell commands and the provider request all get exact-value redaction; Claude Code gets blocks only, through a PreToolUse hook on Read and Bash.
- $Five source types: env, command, mise, pa and 1password; every source takes a required flag that defaults to true, and a failed required source starts the session degraded — fail closed.
- $Vendor prefixes (sk-ant-, ghp_, github_pat_, AKIA, xox[bp]-) are redacted even when no source loaded the key, and minValueLength (default 8) ignores shorter values with a warning naming the key.
- $blockPaths and blockCommands stop reads and commands that print secrets; globs and ${VAR:-fallback} expansion work, and the config file never holds secret values.
- $Order matters in pi: subagent processes load only global extensions, and handlers run in load order, so motus must sit first in packages — an extension loaded earlier sees raw tool output.
- $Claude Code's ! shell mode bypasses the hook because ! commands are not tool calls; pi has no such gap — its user_bash handler redacts ! output too.
- $Web3 safe: no entropy or hex rules, so transaction hashes, addresses and storage slots pass through untouched.
- $The README marks the project as early: 1.0 is not published to npm yet, and the end-to-end smoke test in pi is still open.
## FAQ
Q Does motus need a config file?
Yes. Without ~/.config/motus/config.toml every pi session starts degraded, and the Claude Code hook denies every Read and Bash call. An env source is added by default unless you list your own sources.
Q Why must motus be first in packages?
Handlers run in load order, so an extension loaded earlier sees raw tool output and messages before motus can rewrite them; pi cannot report handler order, so motus does not check the rule either.
Q Does it stop a prompt-injected agent from leaking secrets?
No — the README is explicit that it stops accidental leaks only; a hostile or prompt-injected agent can exfiltrate a secret before any output is redacted, and a sandbox is the suggested mitigation.
Q How does the Claude Code side differ?
Blocks only: the PreToolUse hook denies Read paths and Bash commands matching blockPaths, blockCommands or claudeCode.blockCommands; invalid config, bad input or a crash denies the call too.
Q Which secret sources are supported?
Five: env, a command printing a JSON object, mise with an Age-encrypted list file, pa store entries, and 1Password op:// references resolved in a single op inject call.
## References
## Related entries
$ big-pi
Model-driven compression that summarizes completed phases into tiered blocks while Pi's JSONL transcript stays authoritative and untouched.
$ inception
A curator LLM replaces pi's compaction, rewriting old history every few turns to keep the context dense.
$ Pi Taste
Local preference-learning extension that distills accepted and rejected turns into one readable taste.md.
## Guides
Last updated: Nov 2, 2026