6 Commits

Include renames

Author	SHA1	Message	Date
ic-builder	cf4094b9e4	smcli: self-healing sessions — refresh-token grant + auto-relogin ... Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832	2026-09-07 09:43:50 -05:00
ic-builder	68ba03c1af	smcli setfield: surgical single-field rotation updates; env exposes login triple ... Rotation waves need per-field updates on login items without touching the rest (password/username/custom fields), and consumers need URI/ USERNAME/PASSWORD surfaced by env. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 18:52:34 -05:00
ic-builder	907ddb6000	smcli env: emit URI/USERNAME/PASSWORD for consumers; pin v5 ... convert of login items keeps original env names in fields; env now also exposes the login triple so sourced consumers can map to legacy names. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 17:23:22 -05:00
ic-builder	0dcf41a839	smcli: login-item support + convert command (notes -> username/password/apikey) ... Founder follow-up: lifted items restructured to proper login items (first-class username/password/URIs, remainder as named custom fields). Classified from the env-key semantics; zero data loss. Ticket: https://projects.knownelement.com/issues/829	2026-09-06 16:53:22 -05:00
ic-builder	4728b3cff0	pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw ... Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 16:45:45 -05:00
vptechops	e3e54512a4	feat: container-based Bitwarden CLI, no host Node.js ... Adds the dockerized bw deployment in production use on the TSGCOO orchestration host since 2026-08-13: pinned debian-slim image carrying the pre-compiled bw binary, an in-container auth lifecycle entrypoint (config, API-key login, unlock, sync), a transparent host wrapper, and a one-command installer. ADR-002 records the decision and supersedes ADR-001 for BW CLI purposes: hosts keep zero language runtimes. Known caveat documented: the upstream "native" binary is a Node.js SEA, so Node is embedded in the image though absent from all hosts. Shellcheck clean (zero warnings incl. info-level).	2026-08-14 09:52:05 -05:00