dsh-vault

Anyone who runs long sessions in DeepSeek Harness knows the pain: pasting API tokens, server passwords, and GitHub PATs into every new conversation. dsh-vault moves the credential vault into DSH settings. Fill each category once — token, server login, website account, GitHub credential — and every subsequent session retrieves them automatically. No more copy-paste loops.

Security is the first design principle. Secret fields (tokens, passwords) pass through the UI only at write time; afterwards every surface shows just "configured" or "not configured" with zero plaintext echo. On disk, secrets land in the DSH credential store with 0600 permissions, non-secret fields live in a dedicated settings namespace, and uninstalling the plugin never touches stored keys.

On the agent side, dsh-vault registers two tools: vault_status and vault_get. The former returns a boolean summary of which fields are set; the latter retrieves a specific secret by id and field name, used once and discarded, never restated. This lets the agent resolve credentials on its own during a task — calling a Cloudflare API, SSHing into a server — without you manually feeding parameters every round.

Built for DSH users who juggle multiple projects and credential sets, and who want the agent to grab its own keys rather than being asked for every secret over and over.