pi-mask-public-ip

A Pi coding agent extension that masks public IP addresses and identifying MAC addresses before they leave your machine in a model request.

What it masks

• Public (routable) IPv4 and IPv6 addresses. Private/reserved ranges (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback, link-local, fc00::/7, etc.) are left untouched, since those aren't identifying on their own and masking them would hurt debugging.
• Identifying MAC addresses (all unicast MACs).

Masking is transient and per-call: each real value is replaced with a stable placeholder for the duration of the session (persisted in the session's custom-entry log so the same real value maps to the same placeholder across turns), and any placeholder the model echoes back into a tool call's arguments is restored to the real value before the tool executes. Nothing in the persisted session transcript itself is rewritten — only the outbound copy sent to the model, and the payload right before it's transmitted (before_provider_request), are masked.

Known limitation: the model's own prose reply cannot be rewritten post hoc. If the model has already seen a real IP/MAC before masking took effect (e.g. it was present in an earlier, unmasked context) or otherwise reproduces a raw value in its own generated text, this extension cannot retroactively scrub that reply.

Install

There are two independent ways to enable this extension. Pick one — do not enable both. Enabling both loads the extension twice, which means two independent masking states running in parallel (duplicate/diverging placeholder numbering for the same real IP, since each instance mints its own mapping).

Path A: npm package

Add "npm:pi-mask-public-ip" to the packages array in ~/.pi/agent/settings.json, then run:

pi install npm:pi-mask-public-ip

Confirm it's installed:

pi list

Path B: repo symlink (local development / this repo's deployment)

This repository's setup.sh symlinks pi-extensions/mask-public-ip into ~/.pi/agent/extensions/, which Pi scans automatically. If you run setup.sh from this repo, the extension is already active this way — you do not also need path A.

If you switch from path B to path A (or vice versa), remove the other installation first: delete the ~/.pi/agent/extensions/mask-public-ip symlink before installing via npm, or remove the npm package entry before relying on the repo symlink.

Relationship to the OMP port

The oh-my-pi (OMP) version of this extension at omp-extensions/mask-public-ip shares the same ip-utils.ts masking core as this package (kept byte-identical by a repo test) but is a separate, real port with its own entry point — OMP's extension architecture differs in a few particulars (see index.ts for the specifics). OMP's own extension remains repo-deployed only; whether OMP has an equivalent npm/package manager mechanism has not been verified, so this package does not imply or require any change to how the OMP port is installed.

Publishing (not done by this package)

This package is metadata- and docs-only; it has not been published. To publish manually from the package directory:

npm publish --access public

License

License: not set (internal use)