credentials 10

Out-of-tree dsh plugin: GitLab, GitHub, Gitee, Gitea, and Bitbucket tokens stay out of the model context, stored encrypted (AES-256-GCM) in a plugin-owned file; the model calls forge API tools on demand, and the web settings page manages sites and tokens.

A DeepSeek Harness plugin that binds a separate DeepSeek API key to each workspace, or to a single session, so the spend of one key stays with the sessions you choose.

Personal AI Hub credentials, effective model discovery and native DSH provider integration.

Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.

密码本 for the DeepSeek Harness: an end-to-end encrypted personal secrets book on a private gist (age format, node:crypto only), with a browser page for people and value-free tools for the agent.

Secure credential vault for DeepSeek Harness: store GitHub/npm/API tokens (secrets never leave the host), run gh/npm/npx/node/git with the token injected in the environment, and manage tokens from a Settings page.

Principal-scoped, encrypted user integrations for DSH QA Surface

Authenticated, policy-gated WebFetchProvider for the DeepSeek Harness web capability seam (ctx.web)

Sign in to DeepSeek Harness model providers with a subscription: drives the OAuth flows the harness registers but never exposes.

DSH plugin: OpenCode Go API-key pool with quota-driven automatic switching, a Settings tab and a composer quota badge.