feat(bitwarden): Password Manager / Vaultwarden support with cached session token#779
Open
theoephraim wants to merge 2 commits into
Open
feat(bitwarden): Password Manager / Vaultwarden support with cached session token#779theoephraim wants to merge 2 commits into
theoephraim wants to merge 2 commits into
Conversation
Adds @initBwp / bwp() for the Bitwarden Password Manager (and self-hosted Vaultwarden), accessed through the bw CLI. varlock unlocks the vault itself and caches the resulting session token (encrypted, sessionTtl default 15m), so users no longer have to manually run bw unlock and paste a session token into a .env file. - Auto-unlock by default; sessionToken=$BWP_SESSION or masterPassword= for non-interactive / CI use - Optional cacheTtl to also cache resolved item field values - Self-healing re-unlock when a cached session goes stale (Vault is locked) - bwSessionToken data type; field selection (password/username/notes/totp/uri + custom fields) - Integration tests with a fake bw CLI; docs + README updated
11 tasks
Contributor
|
The changes in this PR will be included in the next version bump.
|
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 8c84706 | Commit Preview URL Branch Preview URL |
Jun 12 2026, 06:58 AM |
commit: |
The cached session token is encrypted at rest with varlock's local key (biometric-gated on platforms with a secure enclave), so day-to-day cache reads are already gated by the user. Bitwarden's own vault-timeout governs when a fresh master-password unlock is actually required (self-healing re-unlocks when the vault locks), so a short varlock-side TTL just adds redundant master-password prompts. Default to forever; overridable via sessionTtl.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #585 (that branch was too stale to rebase, so this re-applies the Password Manager work onto current
mainand redesigns auth around the cache infra that has since landed).Adds Bitwarden Password Manager (and self-hosted Vaultwarden) support to the bitwarden plugin via the
bwCLI — distinct from the existing Secrets Manager support. The key improvement over #585: varlock unlocks the vault itself and caches the session token, so you no longer manually runbw unlockand paste a token into.env.local.What's new
@initBwp()+bwp()— load fields (password/username/notes/totp/uri + custom fields) from vault items by name or UUID.bw unlock(interactive master-password prompt) and caches the resulting session token in varlock's encrypted cache. Eachbw unlockinvalidates prior session keys, so caching is essential, not just convenience.sessionTtldefaults toforever— the cached token is encrypted at rest (biometric/Touch-ID-gated on platforms with a secure enclave), and Bitwarden's own vault-timeout governs when a fresh master-password unlock is actually needed (self-healing re-unlocks when the vault locks). A short varlock-side TTL would just add redundant prompts; setsessionTtlshorter to force periodic master-password re-auth anyway.sessionTokenfor auto-unlock, or passsessionToken=$BWP_SESSION(pre-obtained token) /masterPassword=...for non-interactive / CI use."Vault is locked.") triggers one transparent re-unlock + retry.cacheTtl, mirroring the existingbitwarden()resolver.bwSessionTokendata type.Notes
@initBwp()itself is the signal to usebw— no extra opt-in flag.bwsources (and never auto-installs) given prior supply-chain incidents around the CLI.Tests
9 integration tests against a fake
bwCLI: auto-unlock, manual token, field/custom-field selection, error paths, stale-session re-unlock, and multiple instances. Error mapping validated against the realbwCLI (v2026.3.0).