@yyfather/dsh-token-vault
Secure credential vault for DeepSeek Harness · 凭证库插件
Store your GitHub / npm / API tokens in DSH's own credential store (ctx.credentials → ~/.credentials.yaml). Secrets never leave the host — no plaintext file, no model context, no browser round-trip. The agent uses tokens through vault_run which injects them into a child-process environment only; vault_show (the single disclosure path) requires an explicit confirm: true.
设置 → 凭证库 录入一次，之后所有 GitHub/npm 操作由 Host 侧代持。
Tools (agent-facing)
| Tool | Purpose |
|---|
vault_list | List stored token names only (never values) |
vault_has | Check one token's presence |
vault_set | Store/update a token (value never echoed) |
vault_remove | Delete a token |
vault_import | Import from gh auth token (source: gh) or ~/.npmrc (source: npm) |
vault_run | Run gh/npm/npx/node/git with the token injected via env (github/gh → GH_TOKEN, npm/node → NPM_TOKEN, env_name overrides); output contains no secrets |
vault_show | Reveal one token (requires confirm: true, only on explicit user request) |
Install
dsh plugin --profile desktop add @yyfather/dsh-token-vault
The package declares dsh.bundle.patch so it mounts automatically; restart DSH Desktop to activate. Then manage it from 设置 → 市场 → 已安装 (enable / update / uninstall), or paste tokens in 设置 → 凭证库.
Security design
- Storage: DSH credential record space (
dsh-token-vault/<name>, atomic modifyRecord) — no new plaintext files.
- Usage:
vault_run places the token in the child environment only; stdout/stderr/logs never contain it.
- Disclosure:
vault_show is the only leak path and demands confirm: true; usage rules advise rotating after use.
- Prompt section
token-vault-usage injected automatically: the agent must never print or persist tokens.
Structure
lib/index.js — host: ctx.tools.register for 7 vault tools; webServer routes /vault/status|set|remove|import; systemPrompt.section usage ruleslib/client.js — browser __ModuleLoader__ bundle: Settings → 凭证库 (add / import / delete, values never displayed)cordis.patch.yml — bundle mount patchpackage.json — market-format compliant (strict inject, full exports incl. ./client and ./cordis.patch.yml)
License
MIT © YYfather
