HashiCorp Vault Credential Backend
Store DSH credentials centrally in Vault with AppRole machine authentication and key rotation without service restarts.
Project overview
A HashiCorp Vault backend for the DeepSeek Harness credential seam (ctx.credentials). Provider keys live in Vault; the agent host holds at most a short-lived AppRole-issued token. Why
The shipped provider, @deepseek-ai/dsh-credentials-local, stores keys in a 0600 YAML document under the harness home. Its own README says where that stops: The document is 0600 under a 0700 directory, which stops other OS users — not the model. […] That is discretion, not a boundary. A deployment that must keep provider keys away from its own agent cannot get there with file permissions […] and belongs beside this provider as a sibling package.
The bundle patch disables credentials-local as it inserts this row: ctx.credentials accepts exactly one implementation per context.