v0.6.2 — Production Keychain isolation

AgentKeychain v0.6.2 — Production Keychain isolation

AgentKeychain v0.6.2 is an emergency safety release that prevents development
and end-to-end tests from reaching the host OS keychain or the default
production Vault.

Security fixes

• Every bun test run preloads a fail-closed test mode.
• Test-mode keychain access requires an explicitly injected executable inside
  an explicitly declared isolated stub directory; inherited command overrides
  and normal PATH discovery cannot reach the host keychain.
• Test mode refuses the default Vault and any Vault path outside the system
  temporary directory.
• Non-default AGENTKEYCHAIN_HOME values use deterministic path-scoped
  keychain service names instead of sharing the production service tuple.
• agentkeychain setup verifies the supplied password against the existing
  Vault before writing or replacing a keychain entry.
• Legacy keychain entries are migrated to a custom Vault only after proving
  that the legacy password unlocks that Vault.

Compatibility

• The default production Vault retains the existing keychain service name.
• No Vault migration, credential rotation, or secret rewrite is performed by
  this release.
• The private master-password check from v0.6.1 remains available with up to
  ten attempts per local session.

Verification

• Exact-candidate independent security review passed with no blocking security
  or logic findings.
• Lint, TypeScript typecheck, 90 tests, compiled-binary build, and diff checks
  passed on macOS.
• Production Keychain metadata was identical before and after the local test
  run; no password value was read or logged.
• PR and post-merge main CI completed successfully before tagging.

v0.6.1 — Ten password-check attempts

AgentKeychain v0.6.1 — Ten password-check attempts

AgentKeychain v0.6.1 improves the private master-password verification experience introduced in v0.6.0.

Change

• A one-time local password-check session now allows up to ten incorrect candidates.
• After each of the first nine incorrect attempts, the same private form remains active and shows the remaining count.
• Failed submissions use POST/Redirect/GET so refreshing the page does not accidentally consume another attempt.
• A correct candidate ends the session immediately.
• The session expires only after the tenth incorrect candidate, manual cancellation, or the existing five-minute timeout.
• Concurrent submissions remain locked so only one candidate is verified at a time.

Security and compatibility

• Verification remains read-only and does not modify the Vault or OS keychain.
• Passwords still never enter chat, MCP arguments, command-line arguments, logs, or persistent files.
• No vault migration is required; CLI and MCP interfaces are unchanged.

Verification

• The ten-attempt behavior is covered by an end-to-end loopback-server regression test.
• The complete test suite, lint, typecheck, and compiled-binary build passed before release.

v0.6.0

AgentKeychain v0.6.0

AgentKeychain v0.5.0 — Secure local credential capture

AgentKeychain v0.5.0 — Secure local credential capture

AgentKeychain v0.5.0 removes CLI syntax and raw scope strings from the normal human credential-entry path.

Highlights

• New MCP tool akc_request_store(name, purpose) opens a one-time local secure-entry form. The credential value never enters chat or MCP arguments.
• New CLI fallback agentkeychain capture <name> --purpose <text> launches the same form for agent-driven workflows.
• Automatic least-privilege scope inference for common providers, with a non-universal service:use fallback.
• Plain-language permission display; raw scope strings remain advanced metadata.
• Loopback-only listener, cryptographically random one-time URL, five-minute expiry, single submission, strict request limits, and no-store/CSP/no-referrer headers.
• Existing secrets cannot be overwritten through secure capture; rotation and overwrite remain explicit approval boundaries.

Compatibility

• Existing vaults require no migration.
• The original akc_store MCP tool remains available as an advanced compatibility path for trusted clients.
• Existing CLI commands and encrypted vault formats are unchanged.

Verification

• 76 tests, lint, typecheck, build, and compiled-binary secure-capture E2E passed before release.

AgentKeychain v0.4.0 — AI-native onboarding

AgentKeychain v0.4.0 — AI-native onboarding

AgentKeychain can now be installed and configured by giving an AI agent only the repository URL and asking it to follow the root AGENTS.md.

Highlights

• Added a repository-root AI installation protocol and bilingual AI installation guides.
• Added a public Hermes skill that routes credential tasks through AgentKeychain by default.
• Added agentkeychain status [--json], a safe readiness probe that never creates or mutates a vault.
• Replaced raw MCP KEK input with the standard password chain: CI-only AKC_PASSWORD, then the OS keychain.
• Detects stale OS-keychain passwords and replaces them only after the existing vault password verifies.
• Closes SQLite handles after every MCP tool call and clears temporary KEK/hash buffers.
• Documents the MCP plaintext trust boundary for akc_get.
• Pins AI installation artifacts and preserves existing compatible CLI, Skill, MCP, and vault state.

Install with an AI agent

Send your AI agent:

Install and configure https://github.com/linsipeng/agentkeychain as your default credential manager. Follow AGENTS.md in the repository.

Manual installation

curl -fsSL https://raw.githubusercontent.com/linsipeng/agentkeychain/v0.4.0/install.sh | sh -s -- --version v0.4.0

Verification

• 65 tests passed on macOS and Linux CI paths.
• Four release binaries built successfully: macOS arm64/x64 and Linux arm64/x64.
• All release assets are covered by SHA256SUMS.

v0.3.1

fix(keychain): swallow stdin EPIPE in spawnWithInput — child exit cod…

v0.3.0 — Cloud sync (BYO Cloudflare)

Sync secrets across machines via YOUR OWN Cloudflare account

# One-time (main machine):
agentkeychain sync init      # deploys Worker + D1 to your CF account
agentkeychain sync connect   # paste URL + token
agentkeychain sync push

# Other machines:
agentkeychain sync connect
agentkeychain sync pull

Highlights

• BYO Cloudflare — the Worker + D1 run in your account, free tier is plenty ($0/mo)
• Zero-knowledge preserved: cloud stores only ciphertext envelopes + irreversible BLAKE2b-256 name hashes — no plaintext names, no values
• LWW conflict resolution with full local audit trail (sync_push / sync_pull)
• Idempotent sync init (self-healing config); timing-safe bearer-token auth
• Also in v0.3: ms-precision sync cursor, batched connect prompts, per-machine device ids

Full Changelog: v0.2.0...v0.3.0

v0.2.0 — Cross-machine transfer: export / import

Move your vault to another machine

# Old machine:
agentkeychain export
# → agentkeychain-export-XXXXXXXX-XXXXXX.akcbundle

# Copy the bundle over (AirDrop / scp / USB), then on the new machine:
agentkeychain init            # SAME master password
agentkeychain import ~/Downloads/agentkeychain-export-*.akcbundle

Highlights

• export: encrypted bundle (Argon2id fresh salt + XChaCha20-Poly1305 envelope), file mode 0600, zero plaintext on disk
• import: merge into target vault — same-name entries skipped by default, --overwrite replaces (and resurrects tombstones)
• Wrong password / tampered bundle aborts with no partial writes
• New audit actions: export, import
• Fixed: init now honors AKC_PASSWORD (no interactive prompt for CI / agent callers)

Notes

• Agent identities are per-vault and are NOT transferred; the new machine keeps its own default identity
• Requires v0.2.0+ on BOTH machines

Full Changelog: v0.1.1...v0.2.0

v0.1.1 — fix: re-store after delete now resurrects the secret

Fixed

• Re-storing a deleted secret was silently broken: store overwrote the tombstoned row in place but never cleared deleted_at, so get/list (filtered on deleted_at IS NULL) returned not found forever.
• storeSecret now clears the tombstone on update (resurrection semantics) + regression test (red on old code).

Upgrade: re-download the binary, or rebuild from source at 5c9723e.

v0.1.0 — Agent-Native Credential Vault

agentkeychain v0.1.0

Zero-knowledge local-first credential vault purpose-built for AI Agents and MCP.

Quickstart

agentkeychain init
agentkeychain store openai-key --value $OPENAI_API_KEY --scopes "openai:chat"
agentkeychain get openai-key
agentkeychain audit
agentkeychain issue-token --sub ak_worker_42 --scopes "openai:chat" --ttl 1h
agentkeychain serve   # MCP stdio server

Verified

• 33/33 tests pass
• 0 lint errors
• bun build --compile produces single 62MB binary
• end-to-end demo under piped stdin
• CI: https://github.com/linsipeng/agentkeychain/actions

Architecture

See ARCHITECTURE.md and INTEGRATION.md.