4 Commits

Include renames

Author	SHA1	Message	Date
ic-builder	cf4094b9e4	smcli: self-healing sessions — refresh-token grant + auto-relogin ... Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 09:43:50 -05:00
vpengops	e067eee330	smcli: refresh-token support - sessions no longer die after ~1h ... The login grant requested offline_access but the issued refresh_token was parsed and discarded: every access token died with the ~1h Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until a human re-logged in. - persist refresh_token in state (0600, same file) - add refresh grant (grant_type=refresh_token, rotated token saved) - on 401 for authed calls: refresh once, retry the request - persistTokens() keeps the rest of the state intact Build verified in golang:1.23-alpine (vet + gofmt clean). After deploy, one `sm login` issues a refresh token (~30d, rotated on use) and sessions self-heal from then on.	2026-09-06 22:44:33 -05:00
ic-builder	0dcf41a839	smcli: login-item support + convert command (notes -> username/password/apikey) ... Founder follow-up: lifted items restructured to proper login items (first-class username/password/URIs, remainder as named custom fields). Classified from the env-key semantics; zero data loss. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 16:53:22 -05:00
ic-builder	4728b3cff0	pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw ... Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 16:45:45 -05:00