Credential Vault

What Vault Is

YeePilot Vault is a local encrypted secret store used by the client.

Primary file:

• ~/.yeepilot/vault.json.enc

Vault is locked by default and supports multiple unlock methods with wrapped key material.

Supported Unlock Methods

• password
• pin
• yubikey
• yubikey+pin
• recovery_key

Initialize and Inspect

yeepilot vault init --method password
yeepilot vault status

Unlock and Lock (CLI)

yeepilot vault unlock --method password
yeepilot vault lock

Core Vault Commands

yeepilot vault list --method password
yeepilot vault showmeta <name> --method password
yeepilot vault add-method --unlock-method password --method yubikey
yeepilot vault primary --method pin
yeepilot vault rotate-recovery --unlock-method password

SSH Trust + Connect

# fingerprint scan
yeepilot vault trust-host example.com:22
 
# verify and trust
yeepilot vault trust-host example.com:22 SHA256:...
 
# test connection via vault entry
yeepilot vault connect <entry> --unlock-method password

Portable Bundle Transfer

yeepilot vault portable export backup.ypbundle
yeepilot vault portable import backup.ypbundle

TUI Vault Controls

Useful commands:

• /vault status|init|list|showmeta|add-method|primary|rotate-recovery|autolock
• /unlock [method]
• /lock
• /connect <entry>
• /connect trust <host[:port]> [fingerprint]
• /portable export|import <bundle.ypbundle>
• /vault copy <name> (tier-1 only)
• /vault pwgen <name> [length]
• /vault import-ssh <name> <host> <user> <keyfile> [port]

Config Keys

vault:
  enabled: false
  start_locked: true
  auto_lock_duration: 15m
  bruteforce_protection_enabled: true
  wipe_on_bruteforce_enabled: false
  wipe_after_failures: 15

Security Notes

• Keep at least two unlock methods configured for resilience.
• Store recovery key offline.
• Use host-fingerprint verification for every new SSH host.
• Keep autolock enabled for long-running sessions.