dsh-credentials-vault

The stock credentials-local provider keeps provider keys in a 0600 YAML file on the agent host. File permissions stop other OS users but do nothing against the running agent process itself. In containers, CI pipelines, or headless nodes, that file must be injected by hand, and rotating one key across twenty machines means editing twenty files individually. A stolen disk walks away with a permanent API key, not a short-lived token with a finite lifetime.

dsh-credentials-vault moves keys into a HashiCorp Vault KV v2 secrets engine. The agent host retains only an AppRole credential pair that mints a short-lived lease token, automatically re-logged one minute before expiry so no mid-request auth failure ever surfaces. Rotating a key is a single Vault write; the very next LLM request resolves the new value with no restart and no cache invalidation. Every credential read is recorded in the Vault audit device, answering who read which key and when. Concurrent writes are protected by KV v2 compare-and-swap, so two agents storing different references at the same path cannot silently overwrite each other.

Built for mid-to-large deployments with compliance requirements: container fleets, CI pipelines, multi-node agent clusters, and any team that must keep provider keys off the agent host entirely. It answers where keys should live and how to rotate them safely with full auditability. It does not restrict what a live agent can reach over the network, which is the dsh-egress-guard seam.