Introduction

Within the plugin ecosystem of DeepSeek Harness (DSH), the ctx.credentials seam still requires explicit credential sources. While environment variables can remain read-only, managed values placed in the project or user .env files tend to have weaker permission boundaries and management controls.

Below is an introduction to fieldnote-ops/keyringseam. It is an independently maintained macOS Keychain credential provider for the DSH ctx.credentials seam. Its goal is to place managed values into a private Data Protection Keychain access group and require explicit device owner authentication before every get, set, and unset operation.

What is it

fieldnote-ops/keyringseam is an independently maintained macOS Keychain credential provider for the DeepSeek Harness ctx.credentials seam.

Currently verified information includes:

  • owner is fieldnote-ops
  • license is MIT
  • target system is macOS 13 or later
  • v0.2.0-rc.1 is the public release candidate
  • the project is not affiliated with, sponsored by, or endorsed by DeepSeek or Apple

Core Capabilities

The capabilities listed below are based on verified facts:

  • Independently maintained DeepSeek Harness ctx.credentials credential provider
  • Broker application signed with Developer ID and notarized by Apple
  • Stores managed values in the private Data Protection Keychain access group TU8DF2JWHF.org.fieldnote.keyringseam.broker
  • Requires explicit device owner authentication before every get, set, unset
  • Provides arm64 and x86_64 universal binaries
  • Does not pass host environment or command-line arguments when launching the Broker
  • Supports macOS 13 or later, does not require Swift, Xcode, or Apple command-line developer tools at runtime
  • Environment variables remain read-only and have the highest priority; project and user .env fallback is lower than the managed Keychain source

Installation and Enablement

First, install the specified DSH CLI and pnpm, and verify the versions:

npm install --global pnpm @deepseek-ai/dsh@0.1.0-rc.6
dsh --version
pnpm --version

Then install the public v0.2.0-rc.1 release candidate:

dsh plugin --profile web add github:fieldnote-ops/keyringseam#v0.2.0-rc.1

It is recommended to use one-time credentials for the first run, and check the generated profile diff before using production credentials.

If you need to fall back to the legacy v0.1.3 version, the command is as follows:

dsh plugin --profile web add github:fieldnote-ops/keyringseam#v0.1.3

v0.1.3 is still a legacy storage-only version and cannot be described as Agent isolation.

Typical Verification

The following commands are used for local checks and Broker architecture smoke tests in the maintainer environment:

npm ci
npm run check
node scripts/broker-architecture-smoke.mjs native
node scripts/broker-architecture-smoke.mjs x86_64

Applicable Scenarios and Notes

Suitable for scenarios where you need to integrate a managed Keychain source for the DSH ctx.credentials seam on macOS 13 or later systems.

Please note before use:

  • The plugin runs with the permissions of the current dsh process; please check the source code and license before installing.
  • v0.2.0-rc.1 is a public release candidate.
  • The external acceptance rounds of 3-machine/24-hour have been intentionally delayed.
  • Does not claim independent security review or independent user adoption.
  • v0.1.3 is a legacy storage-only version and cannot be described as Agent isolation.
  • Approval for accidental authentication prompts, compromised macOS accounts, debugger access to trusted Harness hosts, and the trusted hosts themselves is still out of scope.
  • The project is not affiliated with, sponsored by, or endorsed by DeepSeek or Apple.

Conclusion

The value of fieldnote-ops/keyringseam is quite specific: it provides a macOS Keychain credential provider for DSH, a Broker application signed with Developer ID and notarized by Apple, places managed values into a private Data Protection Keychain access group, and requires explicit device owner authentication before every get, set, unset.

Community Directory: https://www.skillhub.cn/plugins/fieldnote-ops/keyringseam

GitHub: https://github.com/fieldnote-ops/keyringseam