amirfish1/claude-command-center/vault

CCC's Vault holds the user's saved secrets (API keys, tokens, logins) in the OS keychain. The ccc vault CLI reads it locally; no server is needed.

1. Find the entry. This prints names, kinds, services and env vars, never values:

ccc vault list --json

1. Run your command with the secret in its environment. The value is redacted

from stdout and stderr, so it never reaches the transcript: ccc vault exec --env STRIPE_API_KEY=stripe-live -- ./deploy.sh ccc vault exec --env stripe-live -- ./deploy.sh (uses the entry's stored env var)

1. To check an entry has a value without reading it: ccc vault get <name> (exit 0 = saved).

Rules:

• Never use get --reveal, and never echo, log, commit, or write a secret to a file.
• Do not pipe secret output out of the exec. Do any piping inside the wrapped command.
• If the entry is missing, do not ask for the value in chat. Run

ccc secret request NAME --reason "..." to show the user a masked prompt in the dashboard.

Details: docs/byok-and-vault.md.