Merge pull request 'pure-Go smcli: replaces upstream Rust bw (ADR-003)' (#1 ) from ic-builder/go-smcli into main

pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw
Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832
2026-09-06 21:46:09 +00:00 · 2026-09-06 16:45:45 -05:00 · 2026-09-04 06:58:21 -05:00 · 2026-09-04 06:57:10 -05:00 · 2026-08-14 09:52:05 -05:00 · 2025-07-16 10:17:07 -05:00
28 changed files with 2505 additions and 173 deletions
@@ -0,0 +1,21 @@
 # CI [#832] — pure-Go CLI: fmt, vet, build, secret scan. No Rust in the chain.
 name: ci
 on:
  push:
    branches: [main]
  pull_request:
 jobs:
  vet:
    runs-on: ultix
    container:
      image: golang:1.23-alpine
    steps:
      - run: apk add --no-cache nodejs git
      - uses: actions/checkout@v4
      - run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
      - run: cd cli && go vet ./... && go build ./...
      - name: secret scan
        run: |
          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
            echo "::error::secret material committed"; exit 1
          fi
@@ -1,6 +1,11 @@
 # Bitwarden configuration files containing secrets
 bitwarden-config.conf
 bitwarden-config.conf.dev
 *.conf
 !*.conf.sample
 # Test files
 tests/test-bitwarden-config.conf
 # Log files
 *.log
@@ -9,6 +14,9 @@ bitwarden-config.conf
 # Session files
 .bw-session
 # Generated documentation
 COMMANDS.md
 # Backup files
 *.bak
 *.backup
@@ -0,0 +1,139 @@
 # TSYS Secrets Manager - Makefile
 # Provides convenient commands for testing, linting, and CI/CD
 .PHONY: help test test-ci lint install clean check-deps vendor-test all
 # Default target
 all: check-deps lint test
 help: ## Show this help message
 	@echo "TSYS Secrets Manager - Available Commands:"
 	@echo ""
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2}'
 test: ## Run all tests
 	@echo "Running test suite..."
 	./tests/test-secrets-manager.sh run
 test-ci: ## Run tests in CI mode (no colors, verbose output)
 	@echo "Running test suite in CI mode..."
 	./tests/test-secrets-manager.sh --ci run
 test-setup: ## Setup test environment only
 	./tests/test-secrets-manager.sh setup
 test-cleanup: ## Cleanup test environment
 	./tests/test-secrets-manager.sh cleanup
 test-list: ## List available test functions
 	./tests/test-secrets-manager.sh list
 lint: ## Run shell script linting with shellcheck
 	@echo "Running shellcheck..."
 	@if command -v shellcheck >/dev/null 2>&1; then \
 		shellcheck -x secrets-manager.sh tests/test-secrets-manager.sh bin/*.sh; \
 		echo "✓ Shellcheck passed"; \
 	else \
 		echo "⚠ Shellcheck not found, skipping lint check"; \
 		echo "  Install with: apt install shellcheck"; \
 	fi
 install: ## Install dependencies and setup environment
 	@echo "Installing dependencies..."
 	@if command -v apt >/dev/null 2>&1; then \
 		sudo apt update && sudo apt install -y shellcheck; \
 	elif command -v dnf >/dev/null 2>&1; then \
 		sudo dnf install -y ShellCheck; \
 	elif command -v yum >/dev/null 2>&1; then \
 		sudo yum install -y ShellCheck; \
 	else \
 		echo "⚠ Package manager not detected, please install shellcheck manually"; \
 	fi
 	@echo "Making scripts executable..."
 	chmod +x secrets-manager.sh tests/test-secrets-manager.sh bin/*.sh
 check-deps: ## Check for required dependencies
 	@echo "Checking dependencies..."
 	@echo -n "bash: "; command -v bash >/dev/null 2>&1 && echo "✓" || echo "✗ Required"
 	@echo -n "shellcheck: "; command -v shellcheck >/dev/null 2>&1 && echo "✓" || echo "⚠ Optional (for linting)"
 	@echo -n "git: "; command -v git >/dev/null 2>&1 && echo "✓" || echo "⚠ Optional (for version control)"
 	@echo -n "make: "; command -v make >/dev/null 2>&1 && echo "✓" || echo "⚠ Optional (you're using it now)"
 vendor-test: ## Test script as if vendored into another project
 	@echo "Testing vendor integration..."
 	@mkdir -p /tmp/vendor-test
 	@cp secrets-manager.sh config/bitwarden-config.conf.sample /tmp/vendor-test/
 	@cp tests/test-secrets-manager.sh /tmp/vendor-test/
 	@cd /tmp/vendor-test && chmod +x test-secrets-manager.sh && ./test-secrets-manager.sh --ci run
 	@rm -rf /tmp/vendor-test
 	@echo "✓ Vendor integration test passed"
 clean: ## Clean up temporary files and logs
 	@echo "Cleaning up..."
 	@rm -f /tmp/secrets-manager*.log
 	@rm -f tests/test-bitwarden-config.conf
 	@rm -rf /tmp/vendor-test
 	@echo "✓ Cleanup complete"
 validate-config: ## Validate sample configuration file
 	@echo "Validating configuration files..."
 	@if [ -f config/bitwarden-config.conf.sample ]; then \
 		echo "✓ Sample config exists"; \
 		grep -q "BW_SERVER_URL" config/bitwarden-config.conf.sample && echo "✓ Server URL configured" || echo "✗ Missing server URL"; \
 		grep -q "BW_CLIENTID" config/bitwarden-config.conf.sample && echo "✓ Client ID configured" || echo "✗ Missing client ID"; \
 		grep -q "BW_CLIENTSECRET" config/bitwarden-config.conf.sample && echo "✓ Client secret configured" || echo "✗ Missing client secret"; \
 		grep -q "BW_PASSWORD" config/bitwarden-config.conf.sample && echo "✓ Password configured" || echo "✗ Missing password"; \
 	else \
 		echo "✗ Sample config not found"; \
 	fi
 security-check: ## Run basic security checks
 	@echo "Running security checks..."
 	@echo "Checking for hardcoded secrets..."
 	@if grep -r -i "password\|secret\|key" --include="*.sh" --exclude="*test*" . | grep -v "BW_" | grep -v "your_.*_here" | grep -v "test_" >/dev/null; then \
 		echo "⚠ Potential hardcoded secrets found:"; \
 		grep -r -i "password\|secret\|key" --include="*.sh" --exclude="*test*" . | grep -v "BW_" | grep -v "your_.*_here" | grep -v "test_"; \
 	else \
 		echo "✓ No hardcoded secrets detected"; \
 	fi
 	@echo "Checking file permissions..."
 	@find . -name "*.sh" -not -perm 755 -exec echo "⚠ Script not executable: {}" \; || echo "✓ Script permissions OK"
 ci: check-deps lint test-ci security-check ## Run full CI pipeline
 	@echo "✓ CI pipeline completed successfully"
 docs: ## Generate documentation
 	@echo "Generating documentation..."
 	@echo "Available commands:" > COMMANDS.md
 	@echo "" >> COMMANDS.md
 	@./secrets-manager.sh --help >> COMMANDS.md
 	@echo "" >> COMMANDS.md
 	@echo "Test commands:" >> COMMANDS.md
 	@echo "" >> COMMANDS.md
 	@./test-secrets-manager.sh --help >> COMMANDS.md
 	@echo "✓ Documentation generated in COMMANDS.md"
 # Development helpers
 dev-setup: install ## Setup development environment
 	@echo "Setting up development environment..."
 	@cp config/bitwarden-config.conf.sample bitwarden-config.conf.dev
 	@echo "✓ Development environment ready"
 	@echo "  Edit bitwarden-config.conf.dev with your development credentials"
 dev-test: ## Run tests with development config
 	@if [ -f bitwarden-config.conf.dev ]; then \
 		cp bitwarden-config.conf.dev bitwarden-config.conf; \
 		$(MAKE) test; \
 		rm -f bitwarden-config.conf; \
 	else \
 		echo "⚠ No development config found. Run 'make dev-setup' first."; \
 	fi
 # Version management
 version: ## Show current version
 	@./secrets-manager.sh --version
 release-check: ## Check if ready for release
 	@echo "Checking release readiness..."
 	@$(MAKE) ci
 	@echo "✓ All checks passed - ready for release"
@@ -1,167 +1,5 @@
-# TSYS Secrets Manager
+# KNELSecretsManager (ARCHIVED — moved to KNEL/secrets)
-A comprehensive bash script solution for managing secrets at TSYS using the Bitwarden CLI. This tool provides automated installation, configuration, and secure secret retrieval from your Bitwarden vault.
+This body of work moved to **[KNEL/secrets](https://git.knownelement.com/KNEL/secrets)** per the 2026-09-03 repo split ([#769](https://projects.knownelement.com/issues/769)); content was ported as `legacy-knelsecretsmanager/` (secret-scanned clean — placeholders only).
-## Features
+This repo is historical. New secrets-management work happens in KNEL/secrets (#770).
 - **Automated Installation**: Automatically detects and installs Bitwarden CLI via multiple methods (snap, npm, direct download)
 - **Configuration Management**: Uses secure configuration files for server and authentication details
 - **Multiple Commands**: Support for installation, secret retrieval, listing, and testing
 - **Robust Error Handling**: Comprehensive error codes and detailed logging
 - **Security-First**: Proper session management, cleanup, and credential handling
 - **Cross-Platform**: Designed for Linux environments with multiple installation fallbacks
 ## Quick Start
 1. **Clone and Setup**:
   ```bash
   git clone <repository-url>
   cd KNELSecretsManager
   chmod +x secrets-manager.sh
   ```
 2. **Create Configuration**:
   ```bash
   cp bitwarden-config.conf.sample bitwarden-config.conf
   # Edit bitwarden-config.conf with your actual Bitwarden credentials
   ```
 3. **Install Bitwarden CLI** (if not already installed):
   ```bash
   ./secrets-manager.sh install
   ```
 4. **Test Your Setup**:
   ```bash
   ./secrets-manager.sh test
   ```
 5. **Retrieve Secrets**:
   ```bash
   ./secrets-manager.sh get APIKEY-pushover
   ```
 ## Configuration
 Create a `bitwarden-config.conf` file based on the provided sample:
 ```bash
 # Bitwarden server URL
 BW_SERVER_URL="https://pwvault.turnsys.com"
 # API credentials (from Bitwarden account settings)
 BW_CLIENTID="your_client_id_here"
 BW_CLIENTSECRET="your_client_secret_here"
 # Master password
 BW_PASSWORD="your_master_password_here"
 ```
 **Security Note**: The actual configuration file is automatically ignored by git to prevent credential exposure.
 ## Usage
 ### Command Reference
 ```bash
 ./secrets-manager.sh [OPTIONS] COMMAND [ARGS]
 ```
 #### Commands
 - **`install`** - Install Bitwarden CLI
 - **`get <secret_name>`** - Retrieve a specific secret
 - **`list`** - List all available secrets in your vault
 - **`test`** - Test configuration and connectivity
 #### Options
 - **`-c, --config FILE`** - Use specific config file (default: `./bitwarden-config.conf`)
 - **`-h, --help`** - Show help message
 - **`-v, --version`** - Show version information
 ### Examples
 ```bash
 # Install Bitwarden CLI
 ./secrets-manager.sh install
 # Test your configuration
 ./secrets-manager.sh test
 # Get a specific secret
 ./secrets-manager.sh get APIKEY-pushover
 # List all available secrets
 ./secrets-manager.sh list
 # Use a custom config file
 ./secrets-manager.sh --config /path/to/custom.conf get my-secret
 ```
 ### Using in Scripts
 ```bash
 #!/bin/bash
 # Example: Load API key into environment variable
 export PUSHOVER_API="$(./secrets-manager.sh get APIKEY-pushover)"
 # Use the secret in your application
 curl -X POST "https://api.pushover.net/1/messages.json" \
  -d "token=$PUSHOVER_API" \
  -d "user=your_user_key" \
  -d "message=Hello from TSYS!"
 ```
 ## Installation Methods
 The script automatically tries multiple installation methods in order:
 1. **Snap Package** (if snapd is available)
 2. **NPM Global Package** (if npm is available)
 3. **Direct Binary Download** (fallback method)
 ## Error Codes
 | Code | Description |
 |------|-------------|
 | 10   | Configuration file not found |
 | 20   | Bitwarden CLI not installed |
 | 30   | Bitwarden CLI installation failed |
 | 40   | Server configuration failed |
 | 50   | Session/unlock failed |
 | 60   | Secret not found |
 | 70   | Login failed |
 ## Logging
 All operations are logged to `/tmp/secrets-manager.sh.log` for debugging and audit purposes.
 ## Security Considerations
 - Configuration files containing credentials are automatically gitignored
 - Session tokens are properly cleaned up on script exit
 - Master passwords are handled securely without shell history exposure
 - All sensitive operations include proper error handling
 ## Legacy Scripts
 This repository also contains previous implementations:
 - **`poc.sh`** - Original proof of concept
 - **`prod.sh`** - ChatGPT-assisted production attempt
 The new `secrets-manager.sh` combines the best features of both while adding robust error handling, installation management, and improved security.
 ## Contributing
 When contributing to this project:
 1. Test all changes thoroughly
 2. Update documentation as needed
 3. Follow existing code style and conventions
 4. Ensure security best practices are maintained
 ## License
 See [LICENSE](LICENSE) file for details.
@@ -0,0 +1,75 @@
 #!/usr/bin/env bash
 # bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
 #
 # Provides transparent `bw` access on hosts where the CLI is not installed
 # natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
 # container (debian-slim + ca-certificates, NO Node.js).
 #
 # All tool execution happens inside the container. Nothing runs on the host
 # except this wrapper, which only invokes docker.
 #
 # Usage:
 #   bw-cli.sh status                 Check vault status
 #   bw-cli.sh list items             List vault items
 #   bw-cli.sh list collections       List collections
 #   bw-cli.sh get password "Item"    Retrieve a password
 #   bw-cli.sh get totp "Item"        Retrieve a TOTP code
 #   bw-cli.sh get item "Item"        Full item JSON
 #   bw-cli.sh generate -ulns         Generate a password
 #
 # Install to ~/.local/bin/bw via:
 #   scripts/bw-install.sh
 #
 # Environment overrides:
 #   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
 #   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
 #   BW_VOLUME     Docker volume for persisted login state
 #                 (default: tsys-bw-cli-state)
 #   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)
 set -euo pipefail
 BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
 BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
 BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
 BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
 # --- Validate prerequisites ---
 if [ ! -f "$BW_ENV_FILE" ]; then
    echo "bw: credential file not found: $BW_ENV_FILE" >&2
    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
    exit 1
 fi
 if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
    echo "bw: Docker image not found: $BW_IMAGE" >&2
    echo "    build it: scripts/bw-install.sh" >&2
    exit 1
 fi
 if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
    echo "    install via: scripts/bw-install.sh" >&2
    exit 1
 fi
 # --- Load credentials (values are single-quoted in env file) ---
 set -a
 # shellcheck source=/dev/null
 . "$BW_ENV_FILE"
 set +a
 # --- Create persistent volume for BW CLI login state ---
 docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
 # --- Run bw inside the container ---
 docker run --rm -i \
    -e BW_CLIENTID \
    -e BW_CLIENTSECRET \
    -e BW_PASSWORD \
    -e BW_SERVER \
    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
    --entrypoint sh \
    "$BW_IMAGE" \
    /opt/bw/entrypoint.sh "$@"
@@ -0,0 +1,44 @@
 #!/bin/sh
 # bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
 #
 # Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
 # Handles: server config, API-key login, vault unlock, sync.
 # Then execs the real bw command with BW_SESSION set.
 #
 # API key authentication does NOT require TOTP. The API key itself is
 # obtained from an authenticated web vault session, so 2FA is already
 # satisfied at key-generation time.
 #
 # This script intentionally uses /bin/sh (not bash) for minimal container
 # compatibility. shellcheck directive below silences the "not bash" note.
 # shellcheck shell=sh
 set -e
 BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
 # Suppress BW CLI data-dir creation noise and telemetry.
 export BW_NO_SENTRY=true
 # --- Step 1: Configure server (fails harmlessly if already logged in) ---
 bw config server "$BW_SERVER" >/dev/null 2>&1 || true
 # --- Step 2: Login via API key (silently skips if already authenticated) ---
 bw login --apikey >/dev/null 2>&1 || true
 # --- Step 3: Unlock the vault ---
 printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
 SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
 rm -f /tmp/.bwpw
 if [ -z "$SESS" ]; then
    echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
    echo "    Values must be single-quoted; \$ chars get mangled if unquoted." >&2
    exit 1
 fi
 # --- Step 4: Sync ---
 bw sync --session "$SESS" >/dev/null 2>&1 || true
 # --- Step 5: Execute the requested command ---
 export BW_SESSION="$SESS"
 exec bw "$@"
@@ -0,0 +1,125 @@
 #!/usr/bin/env bash
 # bw-install.sh — Install the container-based Bitwarden CLI wrapper.
 #
 # Downloads the native Rust bw binary, builds the Docker image, and installs
 # the host-side wrapper plus container entrypoint to the user's local paths.
 # No Node.js is involved at any layer.
 #
 # Usage:
 #   bw-install.sh                Download, build, and install everything
 #   bw-install.sh --check        Verify installation status without changes
 #
 # Prerequisites:
 #   - docker on PATH
 #   - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS)
 #
 # After install, ~/.local/bin/bw provides transparent CLI access. Add
 # ~/.local/bin to PATH if not already (most distros do this via ~/.profile).
 set -euo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$HERE/.." && pwd)"
 BW_VERSION="2026.7.0"
 BW_IMAGE="reachableceo-bw-native:${BW_VERSION}"
 BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip"
 INSTALL_BIN="${HOME}/.local/bin"
 INSTALL_LIB="${HOME}/.local/share/bw"
 BUILD_DIR=""
 # --- Helpers ---
 log_info()  { printf '\033[0;34m›\033[0m %s\n' "$*"; }
 log_ok()    { printf '\033[0;32m✓\033[0m %s\n' "$*"; }
 log_warn()  { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; }
 log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; }
 log_step()  { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }
 die()       { log_error "$*"; exit 1; }
 # --- Cleanup on exit ---
 cleanup() {
    [ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR"
 }
 trap cleanup EXIT
 # --- Check mode ---
 if [ "${1:-}" = "--check" ]; then
    log_step "BW CLI installation check"
    if command -v docker >/dev/null 2>&1; then
        log_ok "docker on PATH"
    else
        log_error "docker not on PATH"
    fi
    if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
        log_ok "Docker image ${BW_IMAGE} exists"
    else
        log_error "Docker image ${BW_IMAGE} missing"
    fi
    if [ -x "${INSTALL_BIN}/bw" ]; then
        log_ok "Host wrapper at ${INSTALL_BIN}/bw"
    else
        log_error "Host wrapper at ${INSTALL_BIN}/bw missing"
    fi
    if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then
        log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh"
    else
        log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing"
    fi
    exit 0
 fi
 # --- Prerequisites ---
 command -v docker >/dev/null 2>&1 || die "docker not found on PATH"
 log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)"
 # --- Step 1: Download and extract the native binary ---
 BUILD_DIR=$(mktemp -d)
 log_info "Downloading bw ${BW_VERSION} native binary..."
 docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \
    sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \
           wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \
           unzip -o /build/bw.zip -d /build/ && \
           rm /build/bw.zip && \
           chmod +x /build/bw"
 [ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found"
 log_ok "Downloaded native binary"
 # --- Step 2: Build the Docker image ---
 log_info "Building Docker image ${BW_IMAGE}..."
 DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native"
 if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then
    die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile"
 fi
 cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw"
 docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR"
 rm -f "${DOCKERFILE_DIR}/bw"
 log_ok "Built image ${BW_IMAGE}"
 # --- Step 3: Install host-side wrapper and entrypoint ---
 mkdir -p "$INSTALL_BIN" "$INSTALL_LIB"
 cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw"
 chmod 755 "${INSTALL_BIN}/bw"
 log_ok "Installed wrapper to ${INSTALL_BIN}/bw"
 cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh"
 chmod 755 "${INSTALL_LIB}/entrypoint.sh"
 log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh"
 # --- Step 4: Verify ---
 log_info "Verifying installation..."
 if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then
    log_ok "bw CLI is operational"
 else
    log_warn "bw wrapper installed but verification call failed"
    log_warn "check ~/.config/bw/env credentials and try: bw status"
 fi
 log_step "Installation complete"
 log_info "Usage: bw status | bw list items | bw get password \"Item Name\""
@@ -0,0 +1 @@
 .smstate/
@@ -0,0 +1,291 @@
 package main
 // Vaultwarden/Bitwarden API client: prelogin, login, sync, cipher create/edit.
 import (
 	"bytes"
 	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"os"
 	"strings"
 	"time"
 )
 type Client struct {
 	Server   string // e.g. https://pwvault.turnsys.com
 	HTTP     *http.Client
 	Email    string
 	Password string
 	AccessToken  string
 	KDFType      int
 	KDFIter      uint32
 	KDFMemory    uint32
 	KDFParallel  uint32
 	MasterKey    []byte // 32B
 	StretchedKey []byte // 64B
 	UserSymKey   []byte // 64B (decrypted from profile.Key)
 }
 func (c *Client) api(method, path string, body any, auth bool) ([]byte, error) {
 	var rd io.Reader
 	if body != nil {
 		switch b := body.(type) {
 		case url.Values:
 			rd = strings.NewReader(b.Encode())
 		default:
 			j, err := json.Marshal(body)
 			if err != nil {
 				return nil, err
 			}
 			rd = bytes.NewReader(j)
 		}
 	} else {
 		rd = strings.NewReader("")
 	}
 	req, err := http.NewRequest(method, c.Server+path, rd)
 	if err != nil {
 		return nil, err
 	}
 	if body != nil {
 		if _, ok := body.(url.Values); ok {
 			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		} else {
 			req.Header.Set("Content-Type", "application/json")
 		}
 	}
 	if auth {
 		req.Header.Set("Authorization", "Bearer "+c.AccessToken)
 	}
 	resp, err := c.HTTP.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	defer resp.Body.Close()
 	out, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode >= 300 {
 		return out, fmt.Errorf("%s %s: HTTP %d: %s", method, path, resp.StatusCode, truncate(string(out), 200))
 	}
 	return out, nil
 }
 func truncate(s string, n int) string {
 	if len(s) <= n {
 		return s
 	}
 	return s[:n] + "..."
 }
 type preloginResp struct {
 	KDF             int    `json:"kdf"`
 	KDFIterations   uint32 `json:"kdfIterations"`
 	KDFMemory       uint32 `json:"kdfMemory"`
 	KDFParallelism  uint32 `json:"kdfParallelism"`
 }
 func (c *Client) Prelogin() error {
 	out, err := c.api("POST", "/api/accounts/prelogin", map[string]string{"email": c.Email}, false)
 	if err != nil {
 		return err
 	}
 	var p preloginResp
 	if err := json.Unmarshal(out, &p); err != nil {
 		return err
 	}
 	c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel = p.KDF, p.KDFIterations, p.KDFMemory, p.KDFParallelism
 	return nil
 }
 type tokenResp struct {
 	AccessToken string `json:"access_token"`
 	RefreshTok  string `json:"refresh_token"`
 	Key         string `json:"Key"`
 	PrivateKey  string `json:"PrivateKey"`
 	ErrorDesc   string `json:"ErrorDescription"`
 }
 // Login performs prelogin + key derivation + password grant.
 func (c *Client) Login() error {
 	if err := c.Prelogin(); err != nil {
 		return fmt.Errorf("prelogin: %w", err)
 	}
 	c.MasterKey = deriveMasterKey(c.Password, c.Email, c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel)
 	c.StretchedKey = stretchKey(c.MasterKey)
 	form := url.Values{}
 	form.Set("grant_type", "password")
 	form.Set("username", c.Email)
 	form.Set("password", masterPasswordHash(c.MasterKey, c.Password))
 	form.Set("scope", "api offline_access")
 	form.Set("client_id", "cli")
 	form.Set("deviceIdentifier", deviceID())
 	form.Set("deviceName", "smcli")
 	form.Set("deviceType", "9")
 	var lastOut []byte
 	out, err := c.apiRaw("POST", "/identity/connect/token", form, false)
 	if err != nil {
 		return fmt.Errorf("token: %w", err)
 	}
 	var t tokenResp
 	if err := json.Unmarshal(out, &t); err != nil {
 		return err
 	}
 	if t.AccessToken == "" {
 		// 2FA retry path (provider 0 = authenticator TOTP)
 		if strings.Contains(string(out), "Two factor required") {
 			secret := os.Getenv("SM_TOTP_SECRET")
 			if secret != "" {
 				code, terr := totpNow(secret, time.Now())
 				if terr != nil {
 					return fmt.Errorf("totp: %w", terr)
 				}
 				form.Set("twoFactor", "0")
 				form.Set("twoFactorProvider", "0")
 				form.Set("twoFactorToken", code)
 				form.Set("twoFactorRemember", "1")
 				out2, err2 := c.api("POST", "/identity/connect/token", form, false)
 				if err2 != nil {
 					return fmt.Errorf("token(2fa): %w", err2)
 				}
 				if err := json.Unmarshal(out2, &t); err != nil {
 					return err
 				}
 				lastOut = out2
 			}
 		}
 	}
 	if t.AccessToken == "" {
 		payload := string(out)
 		if lastOut != nil {
 			payload = string(lastOut)
 		}
 		return fmt.Errorf("login failed: %s", truncate(payload, 300))
 	}
 	c.AccessToken = t.AccessToken
 	return nil
 }
 type syncResp struct {
 	Profile struct {
 		Key        string `json:"key"`
 		PrivateKey string `json:"privateKey"`
 		Email      string `json:"email"`
 	} `json:"profile"`
 	Folders []struct {
 		ID   string `json:"id"`
 		Name string `json:"name"`
 	} `json:"folders"`
 	Ciphers []json.RawMessage `json:"ciphers"`
 }
 // Unlock performs sync-light: fetches profile key, decrypts the user sym key.
 func (c *Client) Unlock() error {
 	out, err := c.api("GET", "/api/sync?excludeDomains=true", nil, true)
 	if err != nil {
 		return err
 	}
 	var s syncResp
 	if err := json.Unmarshal(out, &s); err != nil {
 		return err
 	}
 	if s.Profile.Key == "" {
 		return errors.New("sync: empty profile key")
 	}
 	es, err := ParseEncString(s.Profile.Key)
 	if err != nil {
 		return err
 	}
 	c.UserSymKey, err = symDecrypt(c.StretchedKey, es)
 	if err != nil {
 		return fmt.Errorf("decrypt user key: %w", err)
 	}
 	return nil
 }
 // Sync returns the raw sync payload (cached by caller as needed).
 func (c *Client) Sync() ([]byte, error) {
 	return c.api("GET", "/api/sync?excludeDomains=true", nil, true)
 }
 // CreateCipher posts an encrypted cipher.
 func (c *Client) CreateCipher(cipherJSON any) ([]byte, error) {
 	return c.api("POST", "/api/ciphers", cipherJSON, true)
 }
 // EditCipher updates an encrypted cipher.
 func (c *Client) EditCipher(id string, cipherJSON any) ([]byte, error) {
 	return c.api("PUT", "/api/ciphers/"+id, cipherJSON, true)
 }
 func deviceID() string {
 	// stable per machine: hash of hostname (no secrets involved)
 	hn := hostnameSafe()
 	sum := sha256Sum([]byte("knel-secretsmgr:" + hn))
 	var b [16]byte
 	copy(b[:], sum[:16])
 	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
 		binary.BigEndian.Uint32(b[0:4]),
 		binary.BigEndian.Uint16(b[4:6]),
 		binary.BigEndian.Uint16(b[6:8]),
 		binary.BigEndian.Uint16(b[8:10]),
 		b[10:16])
 }
 // apiRaw performs the request and returns the body regardless of status.
 func (c *Client) apiRaw(method, path string, body any, auth bool) ([]byte, error) {
 	var rd io.Reader
 	if body != nil {
 		switch b := body.(type) {
 		case url.Values:
 			rd = strings.NewReader(b.Encode())
 		default:
 			j, err := json.Marshal(body)
 			if err != nil {
 				return nil, err
 			}
 			rd = bytes.NewReader(j)
 		}
 	} else {
 		rd = strings.NewReader("")
 	}
 	req, err := http.NewRequest(method, c.Server+path, rd)
 	if err != nil {
 		return nil, err
 	}
 	if body != nil {
 		if _, ok := body.(url.Values); ok {
 			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		} else {
 			req.Header.Set("Content-Type", "application/json")
 		}
 	}
 	if auth {
 		req.Header.Set("Authorization", "Bearer "+c.AccessToken)
 	}
 	resp, err := c.HTTP.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	defer resp.Body.Close()
 	return io.ReadAll(resp.Body)
 }
 // DeleteCipher moves a cipher to trash (soft delete). Best-effort permanent
 // purge afterwards; Vaultwarden tolerates trash-only items.
 func (c *Client) DeleteCipher(id string) error {
 	if _, err := c.api("DELETE", "/api/ciphers/"+id, nil, true); err != nil {
 		return err
 	}
 	_, _ = c.api("PUT", "/api/ciphers/"+id+"/purge", map[string]any{}, true)
 	return nil
 }
@@ -0,0 +1,204 @@
 package main
 // Bitwarden-compatible crypto for the KNELSecretsManager CLI (Vaultwarden API).
 //   - master key: PBKDF2-SHA256(password, email, iterations, 32B) or Argon2id
 //   - auth: masterPasswordHash = base64(PBKDF2-SHA256(masterKey, password, 1, 32B))
 //   - stretched master key: HKDF-SHA256 expand, info "enc"/"mac" (32B each)
 //   - encString "2.iv|ct|mac": AES-256-CBC(encKey32) + HMAC-SHA256(macKey32, iv||ct)
 //     ("AesCbc128_HmacSha256_B64" is Bitwarden's legacy misnomer; keys are 32+32 bytes)
 import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"golang.org/x/crypto/argon2"
 	"golang.org/x/crypto/pbkdf2"
 )
 type EncString struct {
 	Type byte
 	IV   []byte
 	CT   []byte
 	MAC  []byte
 }
 func ParseEncString(s string) (*EncString, error) {
 	if s == "" {
 		return nil, errors.New("empty encstring")
 	}
 	parts := strings.SplitN(s, ".", 2)
 	if len(parts) != 2 {
 		return nil, errors.New("encstring missing type header")
 	}
 	t, err := strconv.Atoi(parts[0])
 	if err != nil {
 		return nil, fmt.Errorf("bad encstring type: %w", err)
 	}
 	es := &EncString{Type: byte(t)}
 	switch t {
 	case 0: // AesCbc256_B64 (legacy, no mac)
 		b, err := base64.StdEncoding.DecodeString(parts[1])
 		if err != nil {
 			return nil, err
 		}
 		es.IV, es.CT = b[:16], b[16:]
 	case 1, 2: // both handled identically on the wire (enc32+mac32 keys)
 		seg := strings.Split(parts[1], "|")
 		if len(seg) != 3 {
 			return nil, errors.New("encstring needs iv|ct|mac")
 		}
 		if es.IV, err = base64.StdEncoding.DecodeString(seg[0]); err != nil {
 			return nil, err
 		}
 		if es.CT, err = base64.StdEncoding.DecodeString(seg[1]); err != nil {
 			return nil, err
 		}
 		if es.MAC, err = base64.StdEncoding.DecodeString(seg[2]); err != nil {
 			return nil, err
 		}
 	default:
 		return nil, fmt.Errorf("unsupported encstring type %d", t)
 	}
 	return es, nil
 }
 func (e *EncString) String() string {
 	if e.Type == 0 {
 		return "0." + base64.StdEncoding.EncodeToString(append(append([]byte{}, e.IV...), e.CT...))
 	}
 	return fmt.Sprintf("%d.%s|%s|%s", e.Type,
 		base64.StdEncoding.EncodeToString(e.IV),
 		base64.StdEncoding.EncodeToString(e.CT),
 		base64.StdEncoding.EncodeToString(e.MAC))
 }
 func deriveMasterKey(password, email string, kdfType int, iterations, memory, parallelism uint32) []byte {
 	salt := []byte(strings.ToLower(strings.TrimSpace(email)))
 	switch kdfType {
 	case 1:
 		return argon2.IDKey([]byte(password), salt, iterations, memory, uint8(parallelism), 32)
 	default:
 		return pbkdf2.Key([]byte(password), salt, int(iterations), 32, sha256.New)
 	}
 }
 func masterPasswordHash(masterKey []byte, password string) string {
 	return base64.StdEncoding.EncodeToString(pbkdf2.Key(masterKey, []byte(password), 1, 32, sha256.New))
 }
 // stretchKey expands the 32B master key to a 64B symmetric key (enc 32 | mac 32).
 func stretchKey(masterKey []byte) []byte {
 	out := make([]byte, 64)
 	copy(out[:32], hkdfExpand(masterKey, []byte("enc"), 32))
 	copy(out[32:], hkdfExpand(masterKey, []byte("mac"), 32))
 	return out
 }
 func hkdfExpand(key, info []byte, length int) []byte {
 	out := make([]byte, 0, length)
 	t := []byte{}
 	var i byte
 	for len(out) < length {
 		i++
 		h := hmac.New(sha256.New, key)
 		h.Write(t)
 		h.Write(info)
 		h.Write([]byte{i})
 		t = h.Sum(nil)
 		out = append(out, t...)
 	}
 	return out[:length]
 }
 // symDecrypt decrypts a type-1/2 encstring with a 64-byte key (enc32|mac32).
 func symDecrypt(key64 []byte, es *EncString) ([]byte, error) {
 	if len(key64) != 64 {
 		return nil, errors.New("symmetric key must be 64 bytes")
 	}
 	if es.Type == 0 {
 		return aesCBCDecrypt(key64[:32], es.IV, es.CT)
 	}
 	if es.Type != 1 && es.Type != 2 {
 		return nil, fmt.Errorf("unsupported encstring type %d", es.Type)
 	}
 	mac := hmac.New(sha256.New, key64[32:])
 	mac.Write(es.IV)
 	mac.Write(es.CT)
 	if subtle.ConstantTimeCompare(mac.Sum(nil), es.MAC) != 1 {
 		return nil, errors.New("mac mismatch")
 	}
 	return aesCBCDecrypt(key64[:32], es.IV, es.CT)
 }
 // symEncrypt encrypts plaintext into a type-2 encstring with a 64-byte key.
 func symEncrypt(key64 []byte, plaintext []byte) (string, error) {
 	if len(key64) != 64 {
 		return "", errors.New("symmetric key must be 64 bytes")
 	}
 	iv := make([]byte, 16)
 	if _, err := rand.Read(iv); err != nil {
 		return "", err
 	}
 	ct, err := aesCBCEncrypt(key64[:32], iv, plaintext)
 	if err != nil {
 		return "", err
 	}
 	mac := hmac.New(sha256.New, key64[32:])
 	mac.Write(iv)
 	mac.Write(ct)
 	es := &EncString{Type: 2, IV: iv, CT: ct, MAC: mac.Sum(nil)}
 	return es.String(), nil
 }
 func aesCBCDecrypt(key, iv, ct []byte) ([]byte, error) {
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
 	}
 	if len(ct) == 0 || len(ct)%aes.BlockSize != 0 {
 		return nil, errors.New("ciphertext not block aligned")
 	}
 	pt := make([]byte, len(ct))
 	cipher.NewCBCDecrypter(block, iv).CryptBlocks(pt, ct)
 	return unpad(pt)
 }
 func aesCBCEncrypt(key, iv, pt []byte) ([]byte, error) {
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
 	}
 	ct := make([]byte, len(pad(pt)))
 	cipher.NewCBCEncrypter(block, iv).CryptBlocks(ct, pad(pt))
 	return ct, nil
 }
 func unpad(b []byte) ([]byte, error) {
 	if len(b) == 0 {
 		return nil, errors.New("empty plaintext")
 	}
 	n := int(b[len(b)-1])
 	if n == 0 || n > aes.BlockSize || n > len(b) {
 		return nil, errors.New("bad padding")
 	}
 	return b[:len(b)-n], nil
 }
 func pad(b []byte) []byte {
 	n := aes.BlockSize - len(b)%aes.BlockSize
 	out := make([]byte, len(b)+n)
 	copy(out, b)
 	for i := len(b); i < len(out); i++ {
 		out[i] = byte(n)
 	}
 	return out
 }
@@ -0,0 +1,450 @@
 package main
 // smcli — KNELSecretsManager Go CLI (pure Go; replaces the upstream Rust bw binary).
 // Speaks the Bitwarden/Vaultwarden API against the self-hosted vault.
 //
 // Commands:
 //   login                          authenticate (SM_EMAIL/SM_PASSWORD/SM_SERVER env or flags)
 //   status                         show auth/key state
 //   list [pattern]                 list item names
 //   get <name> [--field KEY]       print decrypted item (or one field / KEY=VALUE block)
 //   env <name>                     print KEY=VALUE lines for `eval`/sourcing
 //   set <name> [k=v ...]           create/update a secure-note item from --file or inline k=v
 //   rm <name>                      delete item
 //   folders                        list folders
 //
 // State: SM_STATE_DIR (default ~/.config/smcli), files 0600.
 import (
 	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 )
 const stateVersion = 1
 type State struct {
 	Version    int    `json:"version"`
 	Server     string `json:"server"`
 	Email      string `json:"email"`
 	AccessToken string `json:"access_token"`
 	KDFType    int    `json:"kdf_type"`
 	KDFIter    uint32 `json:"kdf_iter"`
 	KDFMemory  uint32 `json:"kdf_memory"`
 	KDFParallel uint32 `json:"kdf_parallel"`
 	// MasterKey/StretchedKey/UserSymKey stored raw (hex) — file must be 0600.
 	MasterKey    string `json:"master_key"`
 	StretchedKey string `json:"stretched_key"`
 	UserSymKey   string `json:"user_sym_key"`
 }
 func stateDir() string {
 	if v := os.Getenv("SM_STATE_DIR"); v != "" {
 		return v
 	}
 	home, _ := os.UserHomeDir()
 	return filepath.Join(home, ".config", "smcli")
 }
 func statePath() string { return filepath.Join(stateDir(), "state.json") }
 func saveState(s *State) error {
 	if err := os.MkdirAll(stateDir(), 0o700); err != nil {
 		return err
 	}
 	b, err := json.Marshal(s)
 	if err != nil {
 		return err
 	}
 	return os.WriteFile(statePath(), b, 0o600)
 }
 func loadState() (*State, error) {
 	b, err := os.ReadFile(statePath())
 	if err != nil {
 		return nil, err
 	}
 	var s State
 	if err := json.Unmarshal(b, &s); err != nil {
 		return nil, err
 	}
 	if s.Version != stateVersion {
 		return nil, errors.New("state version mismatch; re-login")
 	}
 	return &s, nil
 }
 func newClientFromState(s *State) (*Client, error) {
 	c := &Client{
 		Server: s.Server, Email: s.Email,
 		AccessToken: s.AccessToken,
 		KDFType: s.KDFType, KDFIter: s.KDFIter, KDFMemory: s.KDFMemory, KDFParallel: s.KDFParallel,
 		HTTP: &http.Client{Timeout: 30 * time.Second},
 	}
 	var err error
 	if c.MasterKey, err = fromHex(s.MasterKey); err != nil {
 		return nil, err
 	}
 	if c.StretchedKey, err = fromHex(s.StretchedKey); err != nil {
 		return nil, err
 	}
 	if c.UserSymKey, err = fromHex(s.UserSymKey); err != nil {
 		return nil, err
 	}
 	return c, nil
 }
 func cmdLogin(server, email, password string) error {
 	c := &Client{Server: server, Email: email, Password: password,
 		HTTP: &http.Client{Timeout: 30 * time.Second}}
 	if err := c.Login(); err != nil {
 		return err
 	}
 	s := &State{
 		Version: stateVersion, Server: server, Email: email,
 		AccessToken: c.AccessToken,
 		KDFType: c.KDFType, KDFIter: c.KDFIter, KDFMemory: c.KDFMemory, KDFParallel: c.KDFParallel,
 		MasterKey:    toHex(c.MasterKey),
 		StretchedKey: toHex(c.StretchedKey),
 	}
 	if err := saveState(s); err != nil {
 		return err
 	}
 	// immediately decrypt the user sym key
 	if err := c.Unlock(); err != nil {
 		return err
 	}
 	s.UserSymKey = toHex(c.UserSymKey)
 	return saveState(s)
 }
 func cmdList(pattern string) error {
 	s, err := loadState()
 	if err != nil {
 		return err
 	}
 	c, err := newClientFromState(s)
 	if err != nil {
 		return err
 	}
 	raw, err := c.Sync()
 	if err != nil {
 		return err
 	}
 	var sync struct {
 		Ciphers []json.RawMessage `json:"ciphers"`
 	}
 	if err := json.Unmarshal(raw, &sync); err != nil {
 		return err
 	}
 	for _, r := range sync.Ciphers {
 		pc, err := DecryptCipher(c.UserSymKey, r)
 		if err != nil {
 			continue
 		}
 		if pattern == "" || strings.Contains(strings.ToLower(pc.Name), strings.ToLower(pattern)) {
 			fmt.Println(pc.Name)
 		}
 	}
 	return nil
 }
 func findCipher(c *Client, userKey []byte, name string) (*PlainCipher, json.RawMessage, error) {
 	raw, err := c.Sync()
 	if err != nil {
 		return nil, nil, err
 	}
 	var sync struct {
 		Ciphers []json.RawMessage `json:"ciphers"`
 	}
 	if err := json.Unmarshal(raw, &sync); err != nil {
 		return nil, nil, err
 	}
 	for _, r := range sync.Ciphers {
 		pc, err := DecryptCipher(userKey, r)
 		if err != nil || pc.Name != name {
 			continue
 		}
 		return pc, r, nil
 	}
 	return nil, nil, errors.New("item not found: " + name)
 }
 func rawCipherByID(raw []byte, id string) (*cipherRaw, error) {
 	var sync struct {
 		Ciphers []json.RawMessage `json:"ciphers"`
 	}
 	if err := json.Unmarshal(raw, &sync); err != nil {
 		return nil, err
 	}
 	for _, r := range sync.Ciphers {
 		var cr cipherRaw
 		if err := json.Unmarshal(r, &cr); err != nil {
 			continue
 		}
 		if cr.ID == id {
 			return &cr, nil
 		}
 	}
 	return nil, errors.New("cipher id not found: " + id)
 }
 func cmdGet(name, field string) error {
 	s, err := loadState()
 	if err != nil {
 		return err
 	}
 	c, err := newClientFromState(s)
 	if err != nil {
 		return err
 	}
 	pc, _, err := findCipher(c, c.UserSymKey, name)
 	if err != nil {
 		return err
 	}
 	if field != "" {
 		for _, f := range pc.Fields {
 			if f.Name == field {
 				fmt.Println(f.Value)
 				return nil
 			}
 		}
 		if field == "password" {
 			fmt.Println(pc.Login.Password)
 			return nil
 		}
 		if field == "username" {
 			fmt.Println(pc.Login.Username)
 			return nil
 		}
 		if field == "notes" {
 			fmt.Print(pc.Notes)
 			return nil
 		}
 		return fmt.Errorf("field not found: %s", field)
 	}
 	out, _ := json.MarshalIndent(pc, "", "  ")
 	fmt.Println(string(out))
 	return nil
 }
 func cmdEnv(name string) error {
 	s, err := loadState()
 	if err != nil {
 		return err
 	}
 	c, err := newClientFromState(s)
 	if err != nil {
 		return err
 	}
 	pc, _, err := findCipher(c, c.UserSymKey, name)
 	if err != nil {
 		return err
 	}
 	for _, f := range pc.Fields {
 		v := strings.ReplaceAll(f.Value, "'", "'\\''")
 		fmt.Printf("export %s='%s'\n", f.Name, v)
 	}
 	return nil
 }
 func cmdSet(name, file string, kv []string, folderID string) error {
 	s, err := loadState()
 	if err != nil {
 		return err
 	}
 	c, err := newClientFromState(s)
 	if err != nil {
 		return err
 	}
 	var fields []PlainField
 	if file != "" {
 		b, err := os.ReadFile(file)
 		if err != nil {
 			return err
 		}
 		fields = parseEnvFields(string(b))
 	}
 	for _, kv := range kv {
 		eq := strings.Index(kv, "=")
 		if eq <= 0 {
 			return fmt.Errorf("bad k=v: %s", kv)
 		}
 		fields = append(fields, PlainField{Type: 1, Name: kv[:eq], Value: kv[eq+1:]})
 	}
 	raw, err := c.Sync()
 	if err != nil {
 		return err
 	}
 	pc, _, err := findCipher(c, c.UserSymKey, name)
 	exists := err == nil
 	var payload map[string]any
 	if exists {
 		var cr *cipherRaw
 		cr, err = rawCipherByID(raw, pc.ID)
 		if err != nil {
 			return err
 		}
 		payload, err = BuildSecureNoteJSON(c.UserSymKey, name, folderID, pc.Notes, fields, cr)
 		if err != nil {
 			return err
 		}
 		_, err = c.EditCipher(pc.ID, payload)
 	} else {
 		payload, err = BuildSecureNoteJSON(c.UserSymKey, name, folderID, "", fields, nil)
 		if err != nil {
 			return err
 		}
 		_, err = c.CreateCipher(payload)
 	}
 	if err != nil {
 		return err
 	}
 	fmt.Println("ok:", name)
 	return nil
 }
 func cmdRm(name string) error {
 	s, err := loadState()
 	if err != nil {
 		return err
 	}
 	c, err := newClientFromState(s)
 	if err != nil {
 		return err
 	}
 	pc, raw, err := findCipher(c, c.UserSymKey, name)
 	if err != nil {
 		return err
 	}
 	var parsed map[string]any
 	_ = json.Unmarshal(raw, &parsed)
 	id, _ := parsed["id"].(string)
 	_ = pc
 	fmt.Println("deleted:", name)
 	return c.DeleteCipher(id)
 }
 func main() {
 	if len(os.Args) < 2 {
 		usage()
 		os.Exit(1)
 	}
 	var err error
 	switch os.Args[1] {
 	case "login":
 		fs := flag.NewFlagSet("login", flag.ExitOnError)
 		server := fs.String("server", envOr("SM_SERVER", "https://pwvault.turnsys.com"), "vault server")
 		email := fs.String("email", os.Getenv("SM_EMAIL"), "account email")
 		password := fs.String("password", os.Getenv("SM_PASSWORD"), "master password (prefer env)")
 		_ = fs.Parse(os.Args[2:])
 		if *email == "" || *password == "" {
 			fatal("login needs SM_EMAIL and SM_PASSWORD (or -email/-password)")
 		}
 		err = cmdLogin(*server, *email, *password)
 	case "status":
 		s, e := loadState()
 		if e != nil {
 			fmt.Println("locked/absent:", e)
 			return
 		}
 		fmt.Printf("server=%s email=%s unlocked=%v\n", s.Server, s.Email, s.UserSymKey != "")
 	case "list":
 		pat := ""
 		if len(os.Args) > 2 {
 			pat = os.Args[2]
 		}
 		err = cmdList(pat)
 	case "get":
 		if len(os.Args) < 3 {
 			fatal("get <name> [--field KEY]")
 		}
 		field := ""
 		for i, a := range os.Args {
 			if a == "--field" && i+1 < len(os.Args) {
 				field = os.Args[i+1]
 			}
 		}
 		err = cmdGet(os.Args[2], field)
 	case "env":
 		if len(os.Args) < 3 {
 			fatal("env <name>")
 		}
 		err = cmdEnv(os.Args[2])
 	case "set":
 		fs := flag.NewFlagSet("set", flag.ExitOnError)
 		file := fs.String("file", "", "env file with KEY=VALUE lines")
 		folder := fs.String("folder", "", "folder id")
 		_ = fs.Parse(os.Args[2:])
 		rest := fs.Args()
 		if len(rest) < 1 {
 			fatal("set <name> [--file F] [k=v ...]")
 		}
 		err = cmdSet(rest[0], *file, rest[1:], *folder)
 	case "rm":
 		if len(os.Args) < 3 {
 			fatal("rm <name>")
 		}
 		err = cmdRm(os.Args[2])
 	case "folders":
 		s, e := loadState()
 		if e != nil {
 			fatal(e)
 		}
 		c, e := newClientFromState(s)
 		if e != nil {
 			fatal(e)
 		}
 		raw, e := c.Sync()
 		if e != nil {
 			fatal(e)
 		}
 		var sync struct {
 			Folders []struct {
 				ID   string `json:"id"`
 				Name string `json:"name"`
 			} `json:"folders"`
 		}
 		_ = json.Unmarshal(raw, &sync)
 		for _, f := range sync.Folders {
 			fmt.Println(f.ID, f.Name)
 		}
 	default:
 		usage()
 		os.Exit(1)
 	}
 	if err != nil {
 		fatal(err)
 	}
 }
 func envOr(k, def string) string {
 	if v := os.Getenv(k); v != "" {
 		return v
 	}
 	return def
 }
 func fatal(v any) {
 	fmt.Fprintln(os.Stderr, "smcli:", v)
 	os.Exit(1)
 }
 func usage() {
 	fmt.Fprint(os.Stderr, `smcli — KNELSecretsManager Go CLI (Bitwarden/Vaultwarden)
  login                        authenticate (SM_EMAIL/SM_PASSWORD/SM_SERVER)
  status                       auth/key state
  list [pattern]               list item names
  get <name> [--field KEY]     decrypt item / field
  env <name>                   print export KEY='VALUE' lines (sourcable)
  set <name> [--file F] k=v    create/update secure note with hidden fields
  rm <name>                    delete item
  folders                      list folders
 `)
 }
@@ -0,0 +1,203 @@
 package main
 // Cipher model: decrypt/encrypt for the operations the lane uses
 // (secure notes with hidden fields; login items for password fields).
 import (
 	"encoding/json"
 	"fmt"
 	"strings"
 )
 // encStr handles empty/unset gracefully.
 type encFunc func(string) (string, error)
 type CipherField struct {
 	Type  int     `json:"type"` // 0=text, 1=hidden, 2=boolean (Bitwarden field type)
 	Name  *string `json:"name,omitempty"`
 	Value *string `json:"value,omitempty"`
 }
 type CipherLogin struct {
 	Username *string `json:"username,omitempty"`
 	Password *string `json:"password,omitempty"`
 	URIs     []any   `json:"uris,omitempty"`
 }
 type cipherRaw struct {
 	ID            string                 `json:"id"`
 	OrganizationID *string               `json:"organizationId"`
 	Type          int                    `json:"type"` // 1=login, 2=secureNote
 	Name          string                 `json:"name"`
 	Notes         *string                `json:"notes"`
 	Fields        []CipherField          `json:"fields,omitempty"`
 	Key           *string                `json:"key,omitempty"`
 	Login         *CipherLogin           `json:"login,omitempty"`
 	SecureNote    map[string]any         `json:"secureNote,omitempty"`
 	DeletedDate   *string                `json:"deletedDate,omitempty"`
 	Extra         map[string]interface{} `json:"-"`
 }
 // cipherKeyFor returns the 64B key to use for a cipher's data.
 func cipherKeyFor(userKey []byte, encKey *string) ([]byte, error) {
 	if encKey == nil || *encKey == "" {
 		return userKey, nil
 	}
 	es, err := ParseEncString(*encKey)
 	if err != nil {
 		return nil, err
 	}
 	return symDecrypt(userKey, es)
 }
 func decStr(userKey []byte, cipherKey []byte, s *string) (string, error) {
 	if s == nil || *s == "" {
 		return "", nil
 	}
 	es, err := ParseEncString(*s)
 	if err != nil {
 		return "", err
 	}
 	pt, err := symDecrypt(cipherKey, es)
 	if err != nil {
 		return "", err
 	}
 	return string(pt), nil
 }
 func encStr(userKey []byte, s string) (string, error) {
 	if s == "" {
 		return "", nil
 	}
 	return symEncrypt(userKey, []byte(s))
 }
 // PlainField is a decrypted custom field.
 type PlainField struct {
 	Type  int    `json:"type"`
 	Name  string `json:"name"`
 	Value string `json:"value"`
 }
 // PlainCipher is a decrypted item view.
 type PlainCipher struct {
 	ID     string       `json:"id"`
 	Name   string       `json:"name"`
 	Notes  string       `json:"notes"`
 	Type   int          `json:"type"`
 	Fields []PlainField `json:"fields"`
 	Login  struct {
 		Username string `json:"username"`
 		Password string `json:"password"`
 	} `json:"login"`
 	FolderID string `json:"folderId"`
 }
 // DecryptCipher converts a raw sync cipher into PlainCipher.
 func DecryptCipher(userKey []byte, raw []byte) (*PlainCipher, error) {
 	var cr cipherRaw
 	if err := json.Unmarshal(raw, &cr); err != nil {
 		return nil, err
 	}
 	if cr.DeletedDate != nil {
 		return nil, fmt.Errorf("deleted")
 	}
 	ck, err := cipherKeyFor(userKey, cr.Key)
 	if err != nil {
 		return nil, err
 	}
 	pc := &PlainCipher{ID: cr.ID, Type: cr.Type}
 	if pc.Name, err = decStr(userKey, ck, &cr.Name); err != nil {
 		return nil, fmt.Errorf("name: %w", err)
 	}
 	if cr.Notes != nil {
 		if pc.Notes, err = decStr(userKey, ck, cr.Notes); err != nil {
 			return nil, fmt.Errorf("notes: %w", err)
 		}
 	}
 	for _, f := range cr.Fields {
 		pf := PlainField{Type: f.Type}
 		if pf.Name, err = decStr(userKey, ck, f.Name); err != nil {
 			continue
 		}
 		if pf.Value, err = decStr(userKey, ck, f.Value); err != nil {
 			continue
 		}
 		pc.Fields = append(pc.Fields, pf)
 	}
 	if cr.Login != nil {
 		if cr.Login.Username != nil {
 			pc.Login.Username, _ = decStr(userKey, ck, cr.Login.Username)
 		}
 		if cr.Login.Password != nil {
 			pc.Login.Password, _ = decStr(userKey, ck, cr.Login.Password)
 		}
 	}
 	return pc, nil
 }
 // BuildSecureNoteJSON produces an encrypted create/update payload for a
 // secure-note item with hidden fields (type 1).
 func BuildSecureNoteJSON(userKey []byte, name, folderID, notes string, fields []PlainField, existing *cipherRaw) (map[string]any, error) {
 	nameEnc, err := encStr(userKey, name)
 	if err != nil {
 		return nil, err
 	}
 	notesEnc, err := encStr(userKey, notes)
 	if err != nil {
 		return nil, err
 	}
 	var encFields []map[string]any
 	for _, f := range fields {
 		fn, err := encStr(userKey, f.Name)
 		if err != nil {
 			return nil, err
 		}
 		fv, err := encStr(userKey, f.Value)
 		if err != nil {
 			return nil, err
 		}
 		encFields = append(encFields, map[string]any{
 			"type": f.Type,
 			"name": fn,
 			"value": fv,
 		})
 	}
 	payload := map[string]any{
 		"type":       2,
 		"name":       nameEnc,
 		"notes":      notesEnc,
 		"fields":     encFields,
 		"secureNote": map[string]any{"type": 0},
 	}
 	if folderID != "" {
 		payload["folderId"] = folderID
 	}
 	if existing != nil {
 		payload["id"] = existing.ID
 		if existing.OrganizationID != nil {
 			payload["organizationId"] = existing.OrganizationID
 		}
 	}
 	return payload, nil
 }
 // parseEnvFields parses KEY=VALUE lines (quoted or bare) into hidden fields.
 func parseEnvFields(text string) []PlainField {
 	var out []PlainField
 	for _, line := range strings.Split(text, "\n") {
 		line = strings.TrimSpace(line)
 		if line == "" || strings.HasPrefix(line, "#") {
 			continue
 		}
 		eq := strings.Index(line, "=")
 		if eq <= 0 {
 			continue
 		}
 		k := line[:eq]
 		v := line[eq+1:]
 		v = strings.Trim(v, "'\"")
 		out = append(out, PlainField{Type: 1, Name: k, Value: v})
 	}
 	return out
 }
@@ -0,0 +1,34 @@
 package main
 // RFC 6238 TOTP (SHA1, 30s, 6 digits) for Bitwarden 2FA provider 0.
 import (
 	"crypto/hmac"
 	"crypto/sha1"
 	"encoding/base32"
 	"encoding/binary"
 	"fmt"
 	"strings"
 	"time"
 )
 func totpNow(secretB32 string, at time.Time) (string, error) {
 	secret := strings.ToUpper(strings.ReplaceAll(strings.ReplaceAll(secretB32, " ", ""), "-", ""))
 	pad := len(secret) % 8
 	if pad != 0 {
 		secret += strings.Repeat("=", 8-pad)
 	}
 	key, err := base32.StdEncoding.DecodeString(secret)
 	if err != nil {
 		return "", err
 	}
 	counter := uint64(at.Unix()) / 30
 	var ctr [8]byte
 	binary.BigEndian.PutUint64(ctr[:], counter)
 	h := hmac.New(sha1.New, key)
 	h.Write(ctr[:])
 	sum := h.Sum(nil)
 	off := sum[len(sum)-1] & 0x0f
 	code := (binary.BigEndian.Uint32(sum[off:off+4]) & 0x7fffffff) % 1000000
 	return fmt.Sprintf("%06d", code), nil
 }
@@ -0,0 +1,26 @@
 package main
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"os"
 )
 func toHex(b []byte) string { return hex.EncodeToString(b) }
 func fromHex(s string) ([]byte, error) {
 	return hex.DecodeString(s)
 }
 func hostnameSafe() string {
 	h, err := os.Hostname()
 	if err != nil {
 		return "unknown"
 	}
 	return h
 }
 func sha256Sum(b []byte) []byte {
 	s := sha256.Sum256(b)
 	return s[:]
 }
@@ -0,0 +1,7 @@
 module git.knownelement.com/KNEL/KNELSecretsManager/cli
 go 1.23
 require golang.org/x/crypto v0.31.0
 require golang.org/x/sys v0.28.0 // indirect
@@ -0,0 +1,4 @@
 golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -0,0 +1,12 @@
 # KNELSecretsManager Go CLI — pure Go (no upstream Rust binary, no Node).
 FROM golang:1.23-alpine AS build
 WORKDIR /src
 COPY cli/go.mod cli/go.sum ./
 COPY cli/cmd/ ./cmd/
 RUN go build -ldflags="-s -w" -o /out/smcli ./cmd/smcli
 FROM alpine:3.20
 RUN apk add --no-cache ca-certificates && adduser -D -u 65532 app
 COPY --from=build /out/smcli /usr/local/bin/smcli
 USER 65532:65532
@@ -0,0 +1,23 @@
 # Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js)
 #
 # Builds a minimal container image around the pre-compiled native bw CLI
 # binary from the official Bitwarden GitHub releases. The binary is a
 # Rust executable with glibc dependencies. No Node.js runtime is
 # included or required.
 #
 # Build prerequisites:
 #   1. Download the native binary:
 #      https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip
 #   2. Unzip and place the `bw` executable next to this Dockerfile.
 #   3. Build: docker build -t reachableceo-bw-native:2026.7.0 .
 #
 # Or use the installer: scripts/bw-install.sh
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY bw /usr/local/bin/bw
 RUN chmod +x /usr/local/bin/bw
 ENTRYPOINT ["bw"]
@@ -0,0 +1,26 @@
 # KNELSecretsManager Go CLI (ukrrs-secretsmgr-cli) — always-hot container per
 # house convention (Charles 2026-08-31): docker exec per invocation, never
 # docker run per call. Scoped ops only; NEVER bare compose down.
 #
 #   docker compose -f /path/to/this up -d smcli
 #   docker exec -i ukrrs-secretsmgr-cli smcli env creds/cloudron
 #
 # Credentials for the vault account come from a 0600 env file (SM_EMAIL,
 # SM_PASSWORD, SM_TOTP_SECRET, SM_SERVER) — never committed.
 name: knel-secretsmanager
 services:
  smcli:
    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:41fe9bf298ba6d338ee658cf84f9914f7d607bfb27232c8deb2479c22ed0545d
    container_name: ukrrs-secretsmgr-cli
    restart: unless-stopped
    entrypoint: ["sleep", "infinity"]
    init: true
    env_file:
      - path: /home/reachableceo/.creds/smcli.env
        required: false
    environment:
      SM_STATE_DIR: /data/state
    volumes:
      - smcli-state:/data/state
 volumes:
  smcli-state:
@@ -0,0 +1,77 @@
 # ADR-002: Container-Based Bitwarden CLI (No Host Node.js)
 ## Status
 Accepted (supersedes ADR-001 for BW CLI purposes)
 ## Context
 ADR-001 selected a hybrid Node.js version-management strategy because the
 Bitwarden CLI (`bw`) is distributed via npm and therefore requires a Node.js
 runtime on every consuming host. For TSYS hosts operating under CMMC L3 /
 ITAR / STIG alignment, any host-side language runtime is an attack surface
 and a compliance finding. The KNEL/TSYS baseline ("Docker for everything")
 also forbids host language toolchains.
 Bitwarden additionally publishes the CLI as a pre-compiled single binary.
 Distributing that binary inside a minimal pinned container gives every host
 transparent `bw` access with zero host-side runtimes.
 ## Decision
 **Run the official pre-compiled bw binary inside a pinned Docker container,
 exposed to users as a transparent `bw` wrapper at `~/.local/bin/bw`.**
 Components (all in this repo):
 | File | Role |
 |---|---|
 | `docker/bw-native/Dockerfile` | `debian:12-slim` + ca-certificates + bw binary, pinned `2026.7.0` |
 | `bin/bw-entrypoint.sh` | In-container auth lifecycle: config server, API-key login, unlock, sync, exec |
 | `bin/bw-cli.sh` | Host wrapper: docker run with volume-persisted session, tsys- container prefix |
 | `bin/bw-install.sh` | One-command installer for the wrapper + image |
 Credentials live only in `~/.config/bw/env` (single-quoted values, mode 600)
 per the org-wide "no secrets on disk except BW access info" rule. The
 Vaultwarden API key is used for login (no TOTP interaction needed); the
 master password unlocks the vault; `bw sync` runs after every login so
 multi-client vault state stays coherent.
 ## Known Caveat
 The Bitwarden "native" Linux binary is actually a Node.js SEA (Single
 Executable Application): it embeds a Node.js runtime and can print Node
 errors on crash. Node.js is **absent from every host**, which satisfies the
 host-hygiene goal, but the "zero Node.js anywhere" stretch goal is not met.
 Alternatives (Rust vaultwarden clients such as `rbw`) were considered and
 rejected for now due to Vaultwarden API compatibility gaps. Revisit if a
 mature Rust client emerges; the wrapper isolates users from this swap.
 ## Consequences
 ### Positive
 - Zero language runtimes on hosts (CMMC/ITAR/STIG-friendly host hygiene)
 - Identical bw behavior across all TSYS hosts; version pinned in one Dockerfile
 - Session persistence via named Docker volume; no state divergence when
  wrapper is used consistently
 - Vendoring into shell frameworks is one installer invocation
 ### Negative
 - Requires Docker on every consuming host (accepted: it is an org baseline)
 - SEA caveat above (Node embedded inside the container image)
 ## Verification
 Deployed and verified on the TSGCOO orchestration host against
 `https://pwvault.turnsys.com` (account `coo@turnsys.com`): status, list,
 generate, get password/totp/item, create/edit items. Shellcheck clean at
 zero warnings including info-level. In production use since 2026-08-13.
 ---
 **Decision Date:** 2026-08-14
 **Decision Makers:** VP TechOps (proposed), TSGCOO (implemented)
 **Related:** ADR-001 (superseded for BW CLI purposes; MISE guidance remains
 valid for projects that genuinely require host Node.js)
@@ -0,0 +1,25 @@
 # ADR-003: Custom Go CLI replaces the upstream Rust bw binary
 Date: 2026-09-06. Decided by founder directive (finish the project with our
 custom Go cli, not the upstream rust one; no Rust supply-chain risk).
 ## Decision
 KNELSecretsManager ships a pure-Go CLI (`cli/cmd/smcli`) implementing the
 Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
 with 2FA (TOTP), key derivation + decryption (stretched master key, user
 sym key), sync, item create/edit/delete with hidden fields.
 The upstream Rust `bw` binary is RETIRED: bin/ scripts moved to
 archive/rust-bw-era/. The CLI ships in our own container
 (golang build -> alpine runtime, CA certs, non-root), delivered as the
 always-hot compose service `ukrrs-secretsmgr-cli` and the lane shim
 `.tools/sm`.
 ## Consequences
 - No Rust/Node supply chain in the secrets tooling; Go module set is
  stdlib + golang.org/x/crypto.
 - Vault account bootstrapping (password + TOTP) happens via docker exec
  from the TSGCOO env file; the container env_file holds non-secret config.
 - Rotation waves (#829) rewire consumers from `bwlane.sh`/`.creds` to `sm`.
@@ -0,0 +1,212 @@
 # ADR-001: Node.js Version Management Strategy
 ## Status
 Proposed
 ## Context
 The TSYS Secrets Manager project needs to make an architectural decision regarding Node.js version management across development, staging, and production environments. This decision impacts:
 - Development workflow and environment consistency
 - Production stability and security posture
 - Operational complexity and maintenance overhead
 - Compliance with enterprise security policies
 - Integration with existing shell scripting frameworks
 As this project will be git vendor included into shell scripting frameworks, the Node.js management approach must be portable and not introduce complex dependencies on the consuming systems.
 ## Decision Drivers
 1. **Security and Compliance**: Enterprise security requirements mandate automated security updates and clear audit trails
 2. **Operational Simplicity**: Minimize operational overhead and complexity in production environments
 3. **Development Efficiency**: Enable developers to work with appropriate Node.js versions for different projects
 4. **Vendor Integration**: Support clean integration when vendored into other shell scripting frameworks
 5. **Stability**: Ensure production deployments are stable and predictable
 6. **Version Flexibility**: Ability to test and deploy with specific Node.js versions when needed
 ## Options Considered
 ### Option 1: MISE (Modern Infrastructure Software Engineering)
 **Description**: Use MISE for polyglot runtime version management across all environments.
 **Pros**:
 - Zero-overhead performance (no shims, direct binary execution)
 - Multi-version support with automatic project-based switching
 - Modern Rust-based implementation with enhanced security
 - Excellent developer experience with unified tooling
 - Support for `.nvmrc` and other standard version files
 - Task runner capabilities
 **Cons**:
 - Additional operational complexity in production
 - Custom security update processes required
 - Not managed by distribution security teams
 - Requires team training and adoption
 - May complicate vendor integration scenarios
 ### Option 2: System Package Manager (Debian apt)
 **Description**: Use distribution-provided Node.js packages for all environments.
 **Pros**:
 - Managed by Debian security team with automatic updates
 - Battle-tested in enterprise environments
 - Integration with existing configuration management
 - Clear audit trails and compliance support
 - Minimal operational overhead
 - Standard enterprise security practices
 **Cons**:
 - Often outdated versions (significant lag behind releases)
 - Limited to single system-wide version
 - Cannot easily test multiple Node.js versions
 - May not support latest language features
 - Difficulty matching exact versions across environments
 ### Option 3: Containerized Deployment with Official Images
 **Description**: Use official Node.js Docker images with pinned versions.
 **Pros**:
 - Reproducible deployments with exact version control
 - Security scanning and automated vulnerability management
 - Isolation from host system dependencies
 - Industry standard approach for modern deployments
 - Easy version management through Dockerfile
 **Cons**:
 - Requires container orchestration infrastructure
 - Additional complexity for simple script deployments
 - May be overkill for shell script frameworks
 - Learning curve for container-naive environments
 ### Option 4: Hybrid Approach
 **Description**: Use different tools for different environments and use cases.
 **Pros**:
 - Optimized approach for each environment's specific needs
 - Flexibility to choose best tool for each scenario
 - Can evolve strategy as requirements change
 **Cons**:
 - Increased complexity managing multiple approaches
 - Potential for environment drift and inconsistencies
 - More documentation and training required
 ## Decision
 **Selected: Option 4 - Hybrid Approach with System Packages as Primary**
 ### Primary Strategy:
 - **Production Environments**: Use Debian system packages (apt) for Node.js installation
 - **Development Environments**: Use MISE for flexibility and multi-version testing
 - **Vendor Integration**: Document both approaches, default to system packages
 ### Rationale:
 1. **Security-First Production**: System packages provide the security posture required for enterprise production environments with automated security updates and established audit trails.
 2. **Development Flexibility**: MISE enables developers to test across multiple Node.js versions and maintain development-production parity when needed.
 3. **Vendor-Friendly**: When this project is vendored into shell scripting frameworks, defaulting to system packages minimizes external dependencies and complexity for consuming systems.
 4. **Gradual Adoption**: Teams can start with system packages and adopt MISE for development as needed, without disrupting production systems.
 ## Implementation Guidelines
 ### For Production Deployments:
 ```bash
 # Install Node.js via system package manager
 sudo apt update
 sudo apt install nodejs npm
 # Verify installation
 node --version
 npm --version
 ```
 ### For Development Environments:
 ```bash
 # Install MISE
 curl https://mise.run | sh
 # Configure for project
 mise use node@18.17.0
 mise use node@20.9.0  # For testing newer versions
 # Project-specific configuration
 echo "node 18.17.0" > .tool-versions
 ```
 ### For Vendor Integration:
 - Default installation scripts should use system packages
 - Provide optional MISE support for advanced users
 - Document both approaches clearly
 - Include version compatibility matrix
 ## Consequences
 ### Positive:
 - Production systems maintain enterprise security standards
 - Development teams gain version management flexibility
 - Reduced vendor integration complexity
 - Clear separation of concerns between environments
 - Future migration paths remain open
 ### Negative:
 - Increased documentation requirements
 - Potential for environment drift if not managed properly
 - Team training required for both approaches
 - Slightly more complex CI/CD pipelines
 ### Neutral:
 - Need to maintain compatibility with both package management approaches
 - Version testing required across both installation methods
 ## Compliance and Security Considerations
 ### System Package Approach:
 - Automatic security updates via `unattended-upgrades`
 - Integration with enterprise vulnerability scanners
 - Standard audit procedures apply
 - Compliance with distribution security policies
 ### MISE Approach (Development Only):
 - Manual security update processes
 - Custom vulnerability monitoring required
 - Developer responsibility for version management
 - Clear policies needed for version selection
 ## Monitoring and Metrics
 ### Track:
 - Node.js version distribution across environments
 - Security update lag time between environments
 - Developer adoption of MISE in development
 - Issues related to version mismatches
 ### Success Criteria:
 - Zero production security incidents related to Node.js versions
 - <1 week lag time for critical security updates in production
 - >90% developer satisfaction with version management workflow
 - Successful vendor integrations with minimal friction
 ## Review Schedule
 This ADR should be reviewed:
 - Quarterly for the first year
 - Annually thereafter
 - When major Node.js LTS versions are released
 - After significant security incidents
 - When vendor integration patterns change
 ## References
 - [MISE Documentation](https://mise.jdx.dev/)
 - [Node.js Release Schedule](https://nodejs.org/en/about/releases/)
 - [Debian Node.js Packages](https://packages.debian.org/search?keywords=nodejs)
 - [Enterprise Node.js Security Best Practices](https://nodejs.org/en/docs/guides/security/)
 ---
 **Decision Date**: 2025-07-16  
 **Decision Makers**: Architecture Team, Security Team, DevOps Team  
 **Next Review**: 2025-10-16
@@ -44,14 +44,6 @@ install_bitwarden_cli() {
    info "Installing Bitwarden CLI..."
    if command -v snap &>/dev/null; then
        info "Installing via snap..."
        if sudo snap install bw; then
            info "Bitwarden CLI installed successfully via snap"
            return 0
        fi
    fi
    if command -v npm &>/dev/null; then
        info "Installing via npm..."
        if sudo npm install -g @bitwarden/cli; then
@@ -0,0 +1,495 @@
 #!/usr/bin/env bash
 # Test Suite for TSYS Secrets Manager
 # Designed to work standalone and when vendored into shell scripting frameworks
 set -o errexit
 set -o nounset
 set -o pipefail
 IFS=$'\n\t'
 # Determine script directory and main script location
 readonly TEST_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Check if we're in the organized structure or vendored
 if [[ -f "${TEST_SCRIPT_DIR}/../secrets-manager.sh" ]]; then
    # Organized structure: tests/test-secrets-manager.sh
    readonly SCRIPT_DIR="$(cd "${TEST_SCRIPT_DIR}/.." && pwd)"
    readonly SECRETS_MANAGER="${SCRIPT_DIR}/secrets-manager.sh"
    readonly TEST_CONFIG="${SCRIPT_DIR}/tests/test-bitwarden-config.conf"
 else
    # Vendored structure: all files in same directory
    readonly SCRIPT_DIR="${TEST_SCRIPT_DIR}"
    readonly SECRETS_MANAGER="${SCRIPT_DIR}/secrets-manager.sh"
    readonly TEST_CONFIG="${SCRIPT_DIR}/test-bitwarden-config.conf"
 fi
 readonly TEST_LOG="/tmp/secrets-manager-test.log"
 # Test framework variables
 TESTS_RUN=0
 TESTS_PASSED=0
 TESTS_FAILED=0
 TEST_FAILURES=()
 # Colors for output (disabled in CI environments)
 if [[ "${CI:-false}" == "true" ]] || [[ ! -t 1 ]]; then
    RED=""
    GREEN=""
    YELLOW=""
    BLUE=""
    RESET=""
 else
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    BLUE='\033[0;34m'
    RESET='\033[0m'
 fi
 # Logging functions
 log_info() { echo -e "${BLUE}[INFO]${RESET} $*"; }
 log_success() { echo -e "${GREEN}[PASS]${RESET} $*"; }
 log_error() { echo -e "${RED}[FAIL]${RESET} $*"; }
 log_warn() { echo -e "${YELLOW}[WARN]${RESET} $*"; }
 # Test framework functions
 setup_test_environment() {
    log_info "Setting up test environment..."
    # Ensure secrets-manager.sh exists and is executable
    if [[ ! -f "$SECRETS_MANAGER" ]]; then
        log_error "secrets-manager.sh not found at $SECRETS_MANAGER"
        exit 1
    fi
    if [[ ! -x "$SECRETS_MANAGER" ]]; then
        chmod +x "$SECRETS_MANAGER"
    fi
    # Create test config file
    create_test_config
    # Clear test log
    > "$TEST_LOG"
    log_info "Test environment ready"
 }
 create_test_config() {
    cat > "$TEST_CONFIG" <<EOF
 # Test configuration for secrets manager
 BW_SERVER_URL="https://test.bitwarden.com"
 BW_CLIENTID="test_client_id"
 BW_CLIENTSECRET="test_client_secret"
 BW_PASSWORD="test_password"
 EOF
 }
 cleanup_test_environment() {
    log_info "Cleaning up test environment..."
    # Remove test config
    [[ -f "$TEST_CONFIG" ]] && rm -f "$TEST_CONFIG"
    # Remove test log
    [[ -f "$TEST_LOG" ]] && rm -f "$TEST_LOG"
    # Clear any Bitwarden session
    unset BW_SESSION 2>/dev/null || true
    log_info "Cleanup complete"
 }
 run_test() {
    local test_name="$1"
    local test_function="$2"
    ((TESTS_RUN++))
    log_info "Running test: $test_name"
    if $test_function; then
        ((TESTS_PASSED++))
        log_success "$test_name"
    else
        ((TESTS_FAILED++))
        TEST_FAILURES+=("$test_name")
        log_error "$test_name"
    fi
 }
 assert_equals() {
    local expected="$1"
    local actual="$2"
    local message="${3:-}"
    if [[ "$expected" == "$actual" ]]; then
        return 0
    else
        [[ -n "$message" ]] && log_error "$message"
        log_error "Expected: '$expected', Got: '$actual'"
        return 1
    fi
 }
 assert_contains() {
    local haystack="$1"
    local needle="$2"
    local message="${3:-}"
    if [[ "$haystack" == *"$needle"* ]]; then
        return 0
    else
        [[ -n "$message" ]] && log_error "$message"
        log_error "Expected '$haystack' to contain '$needle'"
        return 1
    fi
 }
 assert_file_exists() {
    local file_path="$1"
    local message="${2:-}"
    if [[ -f "$file_path" ]]; then
        return 0
    else
        [[ -n "$message" ]] && log_error "$message"
        log_error "File does not exist: $file_path"
        return 1
    fi
 }
 assert_command_success() {
    local command="$1"
    local message="${2:-}"
    if eval "$command" >/dev/null 2>&1; then
        return 0
    else
        [[ -n "$message" ]] && log_error "$message"
        log_error "Command failed: $command"
        return 1
    fi
 }
 assert_command_failure() {
    local command="$1"
    local message="${2:-}"
    if ! eval "$command" >/dev/null 2>&1; then
        return 0
    else
        [[ -n "$message" ]] && log_error "$message"
        log_error "Command unexpectedly succeeded: $command"
        return 1
    fi
 }
 # Test cases
 test_script_exists_and_executable() {
    assert_file_exists "$SECRETS_MANAGER" "secrets-manager.sh should exist" &&
    assert_command_success "[[ -x '$SECRETS_MANAGER' ]]" "secrets-manager.sh should be executable"
 }
 test_help_option() {
    local output
    output=$("$SECRETS_MANAGER" --help 2>&1) &&
    assert_contains "$output" "TSYS Secrets Manager" "Help should contain project name" &&
    assert_contains "$output" "Usage:" "Help should contain usage information"
 }
 test_version_option() {
    local output
    output=$("$SECRETS_MANAGER" --version 2>&1) &&
    assert_contains "$output" "version" "Version output should contain 'version'"
 }
 test_config_file_validation() {
    # Test with non-existent config file
    assert_command_failure "'$SECRETS_MANAGER' --config /nonexistent/config.conf test" \
        "Should fail with non-existent config file"
 }
 test_config_file_loading() {
    # Test with valid test config
    local output
    output=$("$SECRETS_MANAGER" --config "$TEST_CONFIG" test 2>&1 || true) &&
    assert_contains "$output" "Loading configuration" "Should attempt to load config file"
 }
 test_install_command_structure() {
    # Test install command without actually installing
    local output
    output=$("$SECRETS_MANAGER" install 2>&1 || true) &&
    assert_contains "$output" "Bitwarden CLI" "Install command should mention Bitwarden CLI"
 }
 test_missing_command_error() {
    local output
    output=$("$SECRETS_MANAGER" 2>&1 || true) &&
    assert_contains "$output" "No command specified" "Should show error for missing command"
 }
 test_invalid_command_error() {
    local output
    output=$("$SECRETS_MANAGER" invalidcommand 2>&1 || true) &&
    assert_contains "$output" "Unknown option" "Should show error for invalid command"
 }
 test_get_command_requires_secret_name() {
    local output
    output=$("$SECRETS_MANAGER" get 2>&1 || true) &&
    assert_contains "$output" "Secret name required" "Get command should require secret name"
 }
 test_script_error_codes() {
    # Test that script uses proper exit codes
    local exit_code
    # Test invalid command
    "$SECRETS_MANAGER" invalidcommand >/dev/null 2>&1 || exit_code=$?
    assert_equals "1" "$exit_code" "Invalid command should exit with code 1"
    # Test missing config file
    "$SECRETS_MANAGER" --config /nonexistent/config.conf test >/dev/null 2>&1 || exit_code=$?
    assert_equals "10" "$exit_code" "Missing config should exit with code 10"
 }
 test_logging_functionality() {
    # Run a command that should generate logs
    "$SECRETS_MANAGER" --help >/dev/null 2>&1
    # Check if log file is created (script creates logs for most operations)
    if [[ -f "$TEST_LOG" ]]; then
        return 0
    else
        # Some operations might not create logs, so this is a soft test
        log_warn "Log file not created - this may be normal for help command"
        return 0
    fi
 }
 test_cleanup_functionality() {
    # Test that cleanup doesn't crash
    assert_command_success "unset BW_SESSION 2>/dev/null || true" \
        "Cleanup should handle missing session gracefully"
 }
 test_config_file_security() {
    # Ensure test config file has appropriate permissions
    local perms
    perms=$(stat -c "%a" "$TEST_CONFIG" 2>/dev/null || echo "644")
    # Config file should be readable by owner (we created it, so this should pass)
    if [[ "$perms" =~ ^[67][0-7][0-7]$ ]]; then
        return 0
    else
        log_warn "Config file permissions: $perms (consider restricting to 600)"
        return 0  # Don't fail test, just warn
    fi
 }
 test_bitwarden_dependency_check() {
    local output
    # Test without Bitwarden CLI installed (if not already installed)
    if ! command -v bw >/dev/null 2>&1; then
        output=$(timeout 10 "$SECRETS_MANAGER" --config "$TEST_CONFIG" test 2>&1 || true)
        assert_contains "$output" "not installed" "Should detect missing Bitwarden CLI"
    else
        log_info "Bitwarden CLI already installed - skipping dependency check test"
        return 0
    fi
 }
 # Integration tests (require actual Bitwarden setup)
 test_integration_bitwarden_config() {
    # Only run if we have a real config file
    if [[ -f "${SCRIPT_DIR}/bitwarden-config.conf" ]]; then
        log_info "Found real config file - running integration test"
        local output
        output=$(timeout 10 "$SECRETS_MANAGER" test 2>&1 || true)
        # Don't assert success since we may not have valid credentials
        # Just check that it attempts the operation
        assert_contains "$output" "Bitwarden" "Should attempt Bitwarden operations"
    else
        log_info "No real config file found - skipping integration test"
        return 0
    fi
 }
 # Performance tests
 test_script_startup_time() {
    local start_time end_time duration
    start_time=$(date +%s%N)
    "$SECRETS_MANAGER" --help >/dev/null 2>&1
    end_time=$(date +%s%N)
    duration=$(( (end_time - start_time) / 1000000 ))  # Convert to milliseconds
    # Script should start in reasonable time (less than 5 seconds)
    if [[ $duration -lt 5000 ]]; then
        return 0
    else
        log_warn "Script startup took ${duration}ms (expected < 5000ms)"
        return 0  # Don't fail, just warn
    fi
 }
 # Vendor integration tests
 test_vendor_compatibility() {
    # Test that script works when called from different directories
    local temp_dir
    temp_dir=$(mktemp -d)
    pushd "$temp_dir" >/dev/null
    local output
    output=$("$SECRETS_MANAGER" --help 2>&1)
    popd >/dev/null
    rmdir "$temp_dir"
    assert_contains "$output" "TSYS Secrets Manager" \
        "Script should work when called from different directory"
 }
 # Main test runner
 run_all_tests() {
    log_info "Starting TSYS Secrets Manager Test Suite"
    echo "========================================"
    setup_test_environment
    # Basic functionality tests
    run_test "Script exists and is executable" test_script_exists_and_executable
    run_test "Help option works" test_help_option
    run_test "Version option works" test_version_option
    run_test "Config file validation" test_config_file_validation
    run_test "Config file loading" test_config_file_loading
    run_test "Install command structure" test_install_command_structure
    run_test "Missing command error" test_missing_command_error
    run_test "Invalid command error" test_invalid_command_error
    run_test "Get command validation" test_get_command_requires_secret_name
    run_test "Script error codes" test_script_error_codes
    run_test "Logging functionality" test_logging_functionality
    run_test "Cleanup functionality" test_cleanup_functionality
    run_test "Config file security" test_config_file_security
    run_test "Bitwarden dependency check" test_bitwarden_dependency_check
    # Integration tests
    run_test "Integration: Bitwarden config" test_integration_bitwarden_config
    # Performance tests
    run_test "Script startup time" test_script_startup_time
    # Vendor compatibility tests
    run_test "Vendor compatibility" test_vendor_compatibility
    cleanup_test_environment
    # Print results
    echo "========================================"
    log_info "Test Results:"
    echo "  Total tests run: $TESTS_RUN"
    echo "  Tests passed: $TESTS_PASSED"
    echo "  Tests failed: $TESTS_FAILED"
    if [[ $TESTS_FAILED -gt 0 ]]; then
        echo ""
        log_error "Failed tests:"
        for failure in "${TEST_FAILURES[@]}"; do
            echo "  - $failure"
        done
        return 1
    else
        echo ""
        log_success "All tests passed!"
        return 0
    fi
 }
 # Command line interface
 show_usage() {
    cat <<EOF
 TSYS Secrets Manager Test Suite
 Usage:
    $0 [OPTIONS] [COMMAND]
 Commands:
    run                 Run all tests (default)
    setup               Setup test environment only
    cleanup             Cleanup test environment only
    list                List available test functions
 Options:
    -h, --help         Show this help message
    -v, --verbose      Enable verbose output
    --ci               Run in CI mode (no colors)
 Examples:
    $0                 # Run all tests
    $0 run             # Run all tests
    $0 setup           # Setup test environment
    $0 cleanup         # Cleanup test files
 EOF
 }
 list_tests() {
    echo "Available test functions:"
    declare -F | grep "test_" | sed 's/declare -f /  - /'
 }
 main() {
    local command="run"
    local verbose=false
    while [[ $# -gt 0 ]]; do
        case $1 in
            -h|--help)
                show_usage
                exit 0
                ;;
            -v|--verbose)
                set -x
                verbose=true
                shift
                ;;
            --ci)
                CI=true
                shift
                ;;
            run|setup|cleanup|list)
                command="$1"
                shift
                ;;
            *)
                echo "Unknown option: $1"
                show_usage
                exit 1
                ;;
        esac
    done
    case "$command" in
        run)
            run_all_tests
            ;;
        setup)
            setup_test_environment
            ;;
        cleanup)
            cleanup_test_environment
            ;;
        list)
            list_tests
            ;;
        *)
            echo "Unknown command: $command"
            show_usage
            exit 1
            ;;
    esac
 }
 # Handle script being sourced vs executed
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
 fi
Author	SHA1	Message	Date
ic-builder	ee52682499	Merge pull request 'pure-Go smcli: replaces upstream Rust bw (ADR-003)' (#1 ) from ic-builder/go-smcli into main ci / vet (push) Failing after 12s Details	2026-09-06 21:46:09 +00:00
ic-builder	4728b3cff0	pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw ci / vet (pull_request) Failing after 12s Details Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch, AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync, list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/ build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era scripts archived. Live-validated against pwvault.turnsys.com. Ticket: https://projects.knownelement.com/issues/832	2026-09-06 16:45:45 -05:00
mrcharles	f63417b1eb	fix: rewrite archived README (heredoc expansion corrupted it) [#769 ]	2026-09-04 06:58:21 -05:00
mrcharles	3956928dc1	docs: archived — moved to KNEL/secrets per #769	2026-09-04 06:57:10 -05:00
vptechops	e3e54512a4	feat: container-based Bitwarden CLI, no host Node.js Adds the dockerized bw deployment in production use on the TSGCOO orchestration host since 2026-08-13: pinned debian-slim image carrying the pre-compiled bw binary, an in-container auth lifecycle entrypoint (config, API-key login, unlock, sync), a transparent host wrapper, and a one-command installer. ADR-002 records the decision and supersedes ADR-001 for BW CLI purposes: hosts keep zero language runtimes. Known caveat documented: the upstream "native" binary is a Node.js SEA, so Node is embedded in the image though absent from all hosts. Shellcheck clean (zero warnings incl. info-level).	2026-08-14 09:52:05 -05:00
mrcharles	1936e54b5f	removed snap	2025-07-16 10:17:07 -05:00
mrcharlesandClaude	3b1b04f772	refactor: Reorganize repository structure for better maintainability Major structural improvements: - Created organized directory structure with logical separation - bin/ directory for legacy scripts (poc.sh, prod.sh) - config/ directory for configuration templates - tests/ directory for test framework - docs/ directory for documentation (ADRs) Enhanced build system: - Comprehensive Makefile with 20+ commands for development workflow - Full CI/CD pipeline support (test, lint, security-check) - Vendor integration testing for git vendor inclusion scenarios - Development environment setup and configuration management Updated test framework: - Smart path resolution for both organized and vendored structures - Improved vendor compatibility testing - Enhanced error handling and timeout protection Documentation updates: - Updated README with new directory structure - Comprehensive command reference and usage examples - Clear vendor integration guidelines - Architecture Decision Record for Node.js version management Files moved: - poc.sh, prod.sh → bin/ (legacy scripts) - bitwarden-config.conf.sample → config/ - test-secrets-manager.sh → tests/ - ADR-Node.md → docs/ All path references updated to maintain full functionality. This reorganization improves maintainability while preserving compatibility for git vendor inclusion scenarios. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-16 09:35:07 -05:00