Vault & Secrets
Published Updated
The left-sidebar key icon and Settings → Vault. Local AES-256-GCM secret storage that is never sent to Sivants, with global or per-project scoping and project-scope-wins resolution. A two-tab Secrets/Backups interface offers timed reveal, backup health, and a recovery phrase.
MCP tools: orbit_vault_get, orbit_vault_set (create-only), orbit_vault_list, orbit_vault_search, orbit_vault_detect_services.
Deep dive: context/vault-key-storage.md, context/vault-oauth-recovery-design.md.
Operator-approved queued command injection
Section titled “Operator-approved queued command injection”An operator can call orbit_vault_delegate_exec for one running queue row and an existing working session. First call it with confirm: false to preview the exact project, node, session handle, ordered command intents, environment-variable names, vault service aliases, step count, expiry, and one-use rule. Review all fields, then repeat the same request with confirm: true. The response returns a grant handle, never a vault value. Expiry is limited to 15 minutes and a sequence to eight steps.
The worker passes that handle, the exact working_session, queue_row_id, and next vault_step to orbit_exec_shell alongside the approved command and vaultEnv map. Only an authenticated project token bound to that working session can consume it. Each step is reserved before vault resolution or child-process launch. A failed or interrupted step cannot be retried; the operator must approve a new grant. Changing the queue content revision, project, node, session, command, script content, environment name, service alias, actor, or step order rejects execution. The worker can run only the approved steps and cannot view or reuse the secrets.
Delegated commands are limited to existing orbit_exec_shell allowlisted node <relative-script> invocations. The operator should review the script and its dependencies before approval. Vault values are injected into the child environment, and exact values are removed from the returned output. Grant state and audit records contain aliases and digests, not values.
Service Registry & Integrations
Section titled “Service Registry & Integrations”Settings → Integrations. Maps vault keys to known MCP server URLs; connected services show “MCP Available” (Copy URL) or “Built-in Tools,” and unconfigured services show Add Key.
MCP tools: orbit_mcp_detect_services, orbit_mcp_get_service_url.