dsh-credentials-system

DeepSeek Harness credential provider backed by the operating system's user-bound secret protection. Version 0.1 supports Windows x64/ARM64 through DPAPI CurrentUser.

Security properties

• $DSH_HOME/.credentials.system.json contains only versioned DPAPI ciphertext and reference names.
• A blob is bound to the current Windows user, this store id, and its exact credential reference.
• There is no plaintext-file, environment-variable, machine-wide, or local-key fallback.
• describe() returns only configured, source, and writable; there is no reveal API.
• Wrong user, damaged ciphertext, unavailable native backend, and malformed storage fail loudly.
• Explicit portable exports use scrypt plus AES-256-GCM; the passphrase and plaintext are never written beside the export.

This protects a copied credential file and prevents routine configuration views from disclosing values. It cannot protect secrets from malicious code already executing as the Harness process, memory inspection, a compromised Windows account, or a proxy that necessarily receives its own authentication credential.

DeepSeek Harness composition

Replace the built-in plaintext provider; never run it as an automatic fallback:

- id: credentials
  name: '@deepseek-ai/dsh-credentials-local'
  disabled: true

- insert:
    - id: credentials-system
      name: dsh-credentials-system

Consumers store only references, for example:

proxies:
  office:
    url: http://proxy.example:8080
    username: alice
    passwordRef: DSH_PROXY_OFFICE_PASSWORD

The Harness plugin configuration UI should submit a new value through the write-only credentials API. It must render an empty password field plus “configured/not configured”, never a decrypted value or ciphertext.

Portable export

Portable export is an explicit backup/migration operation, not the runtime backend. The complete payload—including reference names—is encrypted using scrypt (N=131072, r=8, p=1) and AES-256-GCM. A wrong passphrase and a damaged file intentionally return the same error.

Important DSH distinction

@deepseek-ai/dsh-credentials-local stores plaintext in $DSH_HOME/.credentials.yaml. Owner-only file permissions and role("secret") redaction are useful boundaries, but they are not encryption. This provider must not silently fall back to it.