The diagrams job ran without a browser (the earlier fix landed on a
deleted branch by mistake). Now installs Debian chromium, points
puppeteer at it, and prints mmdc stderr on failure.
Ticket: https://projects.knownelement.com/issues/832
Vault access tokens expire (~10min); consumers hit 401s after container
recreates. Now: refresh_token persisted at login and rotated on every
refresh (Vaultwarden semantics); 401 on an authed call refreshes once
and retries; if refresh is unavailable, full relogin (password+TOTP
injected by the sm shims from the TSGCOO vault-account env) is attempted
before failing. cmdLogin passes the TOTP seed again (regression).
QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end.
Ticket: https://projects.knownelement.com/issues/832
The login grant requested offline_access but the issued refresh_token
was parsed and discarded: every access token died with the ~1h
Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until
a human re-logged in.
- persist refresh_token in state (0600, same file)
- add refresh grant (grant_type=refresh_token, rotated token saved)
- on 401 for authed calls: refresh once, retry the request
- persistTokens() keeps the rest of the state intact
Build verified in golang:1.23-alpine (vet + gofmt clean). After
deploy, one `sm login` issues a refresh token (~30d, rotated on use)
and sessions self-heal from then on.
The first architecture set did not render (backslash-n escapes,
semicolons in sequence messages, braces in text). All diagrams
rewritten to conservative syntax and QA-verified with mermaid-cli
(3/3 PARSE-OK). qa-diagrams.sh added; CI enforces it on docs changes.
Ticket: https://projects.knownelement.com/issues/832
Rotation waves need per-field updates on login items without touching
the rest (password/username/custom fields), and consumers need URI/
USERNAME/PASSWORD surfaced by env.
Ticket: https://projects.knownelement.com/issues/829
convert of login items keeps original env names in fields; env now also
exposes the login triple so sourced consumers can map to legacy names.
Ticket: https://projects.knownelement.com/issues/832
Founder follow-up: lifted items restructured to proper login items
(first-class username/password/URIs, remainder as named custom fields).
Classified from the env-key semantics; zero data loss.
Ticket: https://projects.knownelement.com/issues/829
Adds the dockerized bw deployment in production use on the TSGCOO
orchestration host since 2026-08-13: pinned debian-slim image carrying
the pre-compiled bw binary, an in-container auth lifecycle entrypoint
(config, API-key login, unlock, sync), a transparent host wrapper, and
a one-command installer.
ADR-002 records the decision and supersedes ADR-001 for BW CLI
purposes: hosts keep zero language runtimes. Known caveat documented:
the upstream "native" binary is a Node.js SEA, so Node is embedded in
the image though absent from all hosts.
Shellcheck clean (zero warnings incl. info-level).
Major enhancements:
- New secrets-manager.sh script with comprehensive functionality
- Automated Bitwarden CLI installation (snap/npm/direct download)
- Configuration file management with sample template
- Multiple commands: install, get, list, test
- Robust error handling with specific exit codes
- Comprehensive logging and session cleanup
- Security improvements: proper gitignore, credential protection
Documentation:
- Complete README rewrite with detailed usage examples
- Installation instructions and troubleshooting guide
- Command reference and error code documentation
- Security considerations and best practices
Files added:
- secrets-manager.sh: Main production script (replaces poc.sh approach)
- bitwarden-config.conf.sample: Configuration template
- .gitignore: Protects credentials and temporary files
This version combines lessons learned from poc.sh and prod.sh attempts,
providing a single, reliable solution for Bitwarden CLI management on Linux.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
ic-builder
reachableceo
vpengops
mrcharles
vptechops
