An agent names the secret and the command. The broker starts the command with the value injected. The agent never holds it, so it never leaks it.
Python. One encrypted SQLite file. Sealed on every restart. Audited before anything moves. By Titanium Computing, built for our own fleet first.
A password manager hands the value to whoever asks. For an agent, "whoever asks" means the terminal, the transcript, the log, and the next tool call. It never forgets.
Unlock once and every pane on the machine rides the same session. One careless worker exposes the whole vault.
Rotation is guesswork when you cannot answer "who touched this key last" and "what breaks if I rotate it".
tw run --env TOKEN=infra/github -- gh pr create. A path and a command. No value in the request, none in the reply.
Who is calling, from which process, with which grant. The audit row commits first. If it cannot be written, nothing moves.
Injected by environment, pipe or stdin into a child the broker starts. Output flows back through a redactor. The agent sees the work, not the key.
Every start, restart, crash or deploy. Keys are not in memory. A human unseals.
The passphrase was typed. Agents can run with secrets. Everything is logged.
Agent operations latched off by an operator. Deleting a file does not clear it.
Panic seal or a failed audit check. Keys dropped. A passphrase clears it.
Under the hood: AES-256-GCM per value, a memory-only master key, Argon2id for the passphrase, one data key per version, every ciphertext bound to its row. Standard parts from one maintained library, no custom cryptography.
Boundary means the protocol makes it impossible. Guardrail means it stops accidents. Today the broker and the agents share one OS user, so Titanwarden stops accidents and records honest use; it is not yet a wall against a deliberately hostile local process. Output redaction is a guardrail: it catches known encodings, not every transform.
The next version runs the broker as its own user with a separate exec runner, and adds auto-unseal so routine restarts need no human. We would rather tell you this on the front page than in a postmortem.
macOS or Linux, Python 3.12 or newer, and SSH from a device you trust. The first setup is deliberately human-only.
# get it git clone <the titanwarden repo> && cd titanwarden uv sync --frozen scripts/install.sh # home, release, tw + twadmin on PATH, broker + watch + backup jobs # the human ceremony, over SSH from your own device twadmin init # passphrase twice (30+ characters); the recovery key prints once twadmin unseal tw status # unsealed, ready for agents