keyringseam

Managing Harness credentials on macOS has traditionally meant trusting a plain-text .env file or a loosely sandboxed command-line helper, leaving secrets exposed to same-user reads, argv leakage, or a simple binary copy. KeyringSeam replaces that legacy file-based Keychain helper with a Developer ID-signed, Apple-notarized Broker application that writes managed values into a private Data Protection Keychain access group, closing the two most common storage-layer threats at the root.

The Broker communicates with the host exclusively over anonymous pipes with a fully emptied child environment and no secret-bearing command-line arguments. Every get, set, or unset operation triggers an explicit device-owner authentication prompt; cancellation, timeout, missing entitlements, or invalid signatures all return errors with no plaintext or legacy-helper fallback path. The universal binary ships both Apple Silicon and Intel slices, so consumer machines need no Swift toolchain, Xcode, or command-line developer tools at runtime, and the package passes Hardened Runtime, secure timestamp, notarization staple, and Gatekeeper quarantine-launch checks end to end.

KeyringSeam is aimed at macOS users running DeepSeek Harness who want to move API keys and tokens out of .env files or shared Keychain entries into a boundary that demands a Touch ID or password confirmation for every credential operation. It is independently maintained by FIELD NOTE under the MIT license and is not affiliated with, sponsored by, or endorsed by DeepSeek or Apple.