dsh-keychain-credentials

Usage

Store a secret (account = credential reference name):

security add-generic-password -U -s dsh-credentials -a DEEPSEEK_API_KEY -w 'sk-…'

The LLM adapter resolves the reference per request — no restart needed after rotation.

Semantics kept from the seam contract:

• Process environment shadows the keychain (per-run operator intent wins).
• An empty stored value counts as absent.
• set/unset reject while a read-only source (the environment) shadows the ref.
• describe checks existence without reading the value — a status query never pulls plaintext into the agent process.
• Errors from the security CLI are sanitized: exit code and stderr only, never the command line (which would carry the secret on a failed set).
• Secrets are fed to security over stdin, never argv, so they never appear in ps.