Sign-ins without the agent seeing the password

Most useful tasks run into a login. Nobody wants to paste a password into a chat, and nobody wants a model to read it off the screen. In Silan the agent never sees a password and never types into a password box itself. It asks for an item by name, you say yes, and Silan types the value from your Mac’s keychain, 1Password or Bitwarden. When you would rather sign in yourself, the agent hands the phone to you and waits.

A worked example

In Settings › Vault you save an item named MegaMart test password, with the note the password of the MegaMart test account and MegaMart as the only app it may go into. Then you send:

Open MegaMart, sign in with my Vault item MegaMart test password, and tell me what is in the cart.

The agent opens MegaMart, taps Sign in and puts the password box in focus. It calls fill_credential with the item’s name. A card asks you: Type “MegaMart test password” from your Vault? with Just this once or For this chat. You press Allow. The live picture shows dots appearing in the box. The step reads Typed "MegaMart test password" with from your Vault · value hidden. The agent taps Log in and reads the cart.

Settings, Vault: the agent sees only the name and the note. Values are never sent to the AI.

If the site uses a one-time code and you set that up in 1Password or Bitwarden, the agent asks for the code the same way. If you would rather type everything yourself, the agent calls request_person_login, the chat says the phone is yours, you sign in on the phone, press Hand back, and the agent goes on.

Steps

1. Open Settings › Vault and add an item. Give it a name, a note for the agent, a type (Password, Key or Text), the apps it may go into, and when Silan asks: every time, once per chat, or not (Vault).
2. For 1Password or Bitwarden, install their command-line tool and sign it in. Silan reads items through it the same way. One-time codes are an opt-in per site.
3. In a task, name the item: sign in with my Vault item NAME. From your own agent, call fill_credential with site and field (username, password or oneTimeCode). See fill_credential.
4. Answer the ask card. Allowed for now in Settings › Safety lists the answers Silan remembers.
5. To sign in yourself, let the agent call request_person_login, or press Take over (request_person_login).

What the agent gets: the item’s name and note, and the words value hidden. Masked text on the screen reaches it as dots. Screenshots and screen recordings paint password boxes black. Typing into a password box is refused for every actor but you, and a Password item goes only into a password box (Safety).

What is supported today

What	Status
Vault items in the Mac’s keychain, typed by Silan on your yes	Supported
1Password and Bitwarden items through their command-line tools	Supported
One-time codes from 1Password or Bitwarden with field: "oneTimeCode"	In testing (works in tests, not yet proved on a phone)
Hand the login to you with request_person_login	Supported
Password boxes black in screenshots and recordings	Supported
Reading a one-time code from the phone’s messages	Not available, and not planned as a feature

Proof

Proved on an iPhone 11 (iOS 27) on a cable, 27 Oct 2026, by a Silan worker with made-up values and a local stand-in model: the agent’s fill of a Password item put 16 dots in a test page’s password box, the runner’s log showed the value only as redacted, and fills of a Key and a Text item into a search box were refused. Proved again on 28 Oct 2026 on the same iPhone, on the cable and over Wi-Fi: the judge confirmed the box held the Vault item, and the system’s Save Password sheet was masked in every read. Source: verify-silan feature map, vault.