插件目录 / Security / dsh-token-vault
dsh-token-vault
已验证 · 实测可装 YYfather
功能简介
Secure credential vault for DeepSeek Harness: tokens never leave the host — the agent runs gh/npm/npx/node/git with the token injected in the environment. Manage from 设置 → 凭证库 / 市场 → 已安装.
可用 — 实测通过，早期项目
Secure credential vault for DeepSeek Harness: tokens never leave the host — the agent runs gh/npm/npx/node/git with the token injected in the environment. Manage from 设置 → 凭证库 / 市场 → 已安装. 实测能干净安装、正常启动。早期项目，但功能可用。
「已验证」表示我们的自动化 CI 在干净 profile 里实际执行了 dsh plugin add 并启动成功——仅此而已。功能描述与版本兼容性均为作者声明。这不是安全审计，也不代表对第三方代码的背书。
README
@yyfather/dsh-token-vault
Secure credential vault for DeepSeek Harness · 凭证库插件
Store your GitHub / npm / API tokens in DSH's own credential store (ctx.credentials → ~/.credentials.yaml). Secrets never leave the host — no plaintext file, no model context, no browser round-trip. The agent uses tokens through vault_run which injects them into a child-process environment only; vault_show (the single disclosure path) requires an explicit confirm: true.
设置 → 凭证库 录入一次，之后所有 GitHub/npm 操作由 Host 侧代持。
Tools (agent-facing)
| Tool | Purpose |
|---|---|
vault_list |
List stored token names only (never values) |
vault_has |
Check one token's presence |
vault_set |
Store/update a token (value never echoed) |
vault_remove |
Delete a token |
vault_import |
Import from gh auth token (source: gh) or ~/.npmrc (source: npm) |
vault_run |
Run gh/npm/npx/node/git with the token injected via env (github/gh → GH_TOKEN, npm/node → NPM_TOKEN, env_name overrides); output contains no secrets |
vault_show |
Reveal one token (requires confirm: true, only on explicit user request) |
Install
dsh plugin --profile desktop add @yyfather/dsh-token-vault
The package declares dsh.bundle.patch so it mounts automatically; restart DSH Desktop to activate. Then manage it from 设置 → 市场 → 已安装 (enable / update / uninstall), or paste tokens in 设置 → 凭证库.
Security design
- Storage: DSH credential record space (
dsh-token-vault/<name>, atomicmodifyRecord) — no new plaintext files. - Usage:
vault_runplaces the token in the child environment only; stdout/stderr/logs never contain it. - Disclosure:
vault_showis the only leak path and demandsconfirm: true; usage rules advise rotating after use. - Prompt section
token-vault-usageinjected automatically: the agent must never print or persist tokens.
Structure
lib/index.js— host:ctx.tools.registerfor 7 vault tools;webServerroutes/vault/status|set|remove|import;systemPrompt.sectionusage ruleslib/client.js— browser__ModuleLoader__bundle: Settings → 凭证库 (add / import / delete, values never displayed)cordis.patch.yml— bundle mount patchpackage.json— market-format compliant (strictinject, fullexportsincl../clientand./cordis.patch.yml)
License
MIT © YYfather
安装
装一次目录插件，之后本站所有插件都能让 DeepSeek Harness 自动找、自动装：
dsh plugin add dshbase-catalog然后对 agent 说「帮我装 dsh-token-vault」，它会在目录里找到并自动安装。文档：dshbase-catalog · 已验证场景包。
该插件是 GitHub 源码（未发 npm）——直接从仓库装：
Web profile：
dsh plugin --profile web add github:YYfather/dsh-token-vaultHeadless（CLI）profile：
dsh plugin --profile headless add github:YYfather/dsh-token-vault实测报告
验证通过：从 GitHub 源码完成 L1 安装 + L2 加载 + L3 运行（dsh 0.1.0-rc.6）。
分享徽章
把这枚徽章粘进 README——它会链回本页，实测状态变化时自动更新：
[](https://dshbase.com/zh/plugins/dsh-token-vault/)<a href="https://dshbase.com/zh/plugins/dsh-token-vault/"><img src="https://dshbase.com/badges/dsh-token-vault.svg" alt="dshbase 实测可装"></a>