agent-id-vault

name	agent-id-vault
description	Encrypted credential vault keyed off the agent's Alien Agent ID private key. Store, retrieve, list, and remove external-service credentials (GitHub PAT, Slack token, AWS keys, etc.) without ever hardcoding secrets. Use when the user asks to save, fetch, or remove a service credential, or whenever a downstream tool needs an external-service secret that should not appear in shell history, source files, or process arguments. Use when this capability is needed.
metadata	{"author":"alien-id"}

Alien Agent ID — Vault

Encrypted storage for external-service credentials. The encryption key is derived from the agent's main private key via HKDF-SHA256, so credentials are only readable on the same machine as the bound agent. Encryption is AES-256-GCM with a fresh IV per write.

Requires that agent-id-setup bootstrap has already produced a keypair under ${AGENT_ID_STATE_DIR:-$HOME/.agent-id}.

Resolve the CLI

bin/cli.mjs lives in this plugin's directory. Substitute CLI with the absolute path (e.g. node /abs/path/to/plugins/agent-id-vault/bin/cli.mjs) in the examples below.

Store a credential

# Most secure — never appears in argv or shell history:
node CLI store --service github --credential-file /tmp/gh-token

# From an environment variable (typed/pasted into the calling shell):
GH_TOKEN=ghp_... node CLI store --service github --credential-env GH_TOKEN

# Piped via stdin:
echo "$GH_TOKEN" | node CLI store --service github


node CLI store --service github --credential