... agent goes, the secret follows. So we built toani Vault: an open-source credential vault where the agent literally never gets the secret. It sends an intent ("fill the password field"), the credential is decrypted inside an Intel SGX enclave, and the plaintext never leaves. Everything MIT licensed CLI, SDK, enclave