dsh-keychain-credentials
DeepSeek Harness (dsh) 的 macOS Keychain 凭据提供程序——引用和记录均存储在登录钥匙串中，绝不存储于纯文本文件
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:nengong-ai/dsh-keychain-credentials#663462af565e7290f4fb9fcd56070f5a1d8a9d4bKeychain Credentials 以 dsh-keychain-credentials 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
macOS Keychain credentials provider for DeepSeek Harness (dsh).
The stock provider (dsh-credentials-local) stores secrets in $DSH_HOME/.credentials.yaml with 0600 permissions. As its own README states: that file is protected from other OS users, but not from the model — tool processes (bash, filesystem tools) run as the same user and can read it like any other file.
This provider moves secrets into the macOS login keychain. A file that does not exist cannot be cat-ed; nothing lands in backups, sync folders, or git.
read, cat, grep, tar, node -e …, in-process or subprocess. With this provider, values live in the login keychain./usr/bin/security — the CLI is ACL-trusted and no prompt appears. An agent with an unrestricted shell that knows to ask the keychain can still exfiltrate. Pairing with a sandbox that constrains tool subprocesses narrows this; a hard boundary needs OS-level separation (a signed broker with a private access group, e.g. keyringseam, or a separate OS user).Net: the bar rises from "any read primitive" to "must exec /usr/bin/security as the same user" — a real improvement, not a complete boundary.
ctx.credentials — refs (API keys) and records (structured credentials like client-connection/browser-session grants). Several other providers implement only the refs half, which means DSH's own session records fall back to the plaintext file./usr/bin/security)dsh plugin --profile web add dsh-keychain-credentials
# or from source:
dsh plugin --profile web add github:<you>/dsh-keychain-credentials
Then the bundle's cordis.patch.yml disables the stock provider and mounts this one. If you prefer to wire it by hand, add to your patch layer (~/.dsh/cordis.patch.yml or --patch <file>):
- id: credentials
disabled: true
- insert:
- id: credentials-keychain
name: dsh-keychain-credentials
config:
servicePrefix: dsh-credentials # keychain service prefix
account: dsh # keychain account name
Store a secret (account = credential reference name):
security add-generic-password -U -s dsh-credentials -a DEEPSEEK_API_KEY -w 'sk-…'
The LLM adapter resolves the reference per request — no restart needed after rotation.
Semantics kept from the seam contract:
set/unset reject while a read-only source (the environment) shadows the ref.describe checks existence without reading the value — a status query never pulls plaintext into the agent process.security CLI are sanitized: exit code and stderr only, never the command line (which would carry the secret on a failed set).security over stdin, never argv, so they never appear in ps.npm test
Requires a real DSH node_modules (peer deps) — run from a profile with @deepseek-ai/dsh-credentials installed, or symlink one.
MIT