tancheng33/dsh-credentials-vault

README excerpt

dsh-credentials-vault English 中文 A HashiCorp Vault backend for the DeepSeek Harness credential seam ( ctx.credentials ). Provider keys live in Vault; the agent host holds at most a short-lived AppRole-issued token. Why The shipped provider, @deepseek-ai/dsh-credentials-local , stores keys in a 0600 YAML document under the harness home. Its own README says where that stops: The document is 0600 under a 0700 directory, which stops other OS users — not the model. […] That is discretion, not a boundary. A deployment that must keep provider keys away from its own agent cannot get there with file permissions […] and belongs beside this provider as a sibling package. This is the central answer to that, as distinct from a per-machine OS keychain: credentials-local OS keychain dsh-credentials-vault Where the key lives file on the agent host that machine's keychain Vault Headless / container / CI agent file must be shipped in no keychain to speak of works — AppRole login Rotating a key across 20 agents edit 20 files 20 machines one Vault write Who read the key, when not recorded not recorded Vault audit device Bootstrap secret on the host the key itself none a role id + secret id, not the ke…

Category