docs QA: diagrams must parse in a real mermaid renderer

The first architecture set did not render (backslash-n escapes,
semicolons in sequence messages, braces in text). All diagrams
rewritten to conservative syntax and QA-verified with mermaid-cli
(3/3 PARSE-OK). qa-diagrams.sh added; CI enforces it on docs changes.

Ticket: https://projects.knownelement.com/issues/832

.gitea/workflows/ci.yml

@@ -0,0 +1,41 @@
+# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan + diagram QA.
+# Diagram QA needs chromium: runs only when docs change.
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  vet:
+    runs-on: ultix
+    container:
+      image: golang:1.23-alpine
+    steps:
+      - run: apk add --no-cache nodejs git
+      - uses: actions/checkout@v4
+      - run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
+      - run: cd cli && go vet ./... && go build ./...
+      - name: secret scan
+        run: |
+          if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
+            echo "::error::secret material committed"; exit 1
+          fi
+  diagrams:
+    runs-on: ultix
+    container:
+      image: node:20-bookworm
+    steps:
+      - uses: actions/checkout@v4
+      - name: mermaid blocks must parse
+        run: |
+          apt-get update -qq >/dev/null && apt-get install -qq -y gawk >/dev/null
+          # renderer + chromium inside minlag/mermaid-cli; mmdc parses without page render
+          QA=$(mktemp -d)
+          awk '/^```mermaid/{n++; f=QA"/d"n".mmd"; next} /^```/{f=""; next} f!=""{print > f}' QA="$QA" docs/*.md
+          echo '{"args":["--no-sandbox","--disable-setuid-sandbox","--disable-gpu"]}' > "$QA/pptr.json"
+          docker_target=skip
+          for f in "$QA"/d*.mmd; do
+            [ -f "$f" ] || continue
+            npx -y @mermaid-js/mermaid-cli@11 -p "$QA/pptr.json" -i "$f" -o /tmp/out.svg >/dev/null 2>&1 || { echo "::error::unrenderable diagram: $f"; exit 1; }
+            echo "PARSE-OK: $f"
+          done

README.md

@@ -1,268 +1,43 @@
-# TSYS Secrets Manager
+# KNELSecretsManager
 
-A comprehensive bash script solution for managing secrets at TSYS using the Bitwarden CLI. This tool provides automated installation, configuration, and secure secret retrieval from your Bitwarden vault.
+Fleet secrets management: a **pure-Go Bitwarden/Vaultwarden CLI** (`smcli`)
+in a house container, backed by the self-hosted TSGCOO vault. No upstream
+Rust `bw` binary, no Node runtime, no `.creds` text files — those patterns
+are retired (ADR-003; founder rulings #829/#832).
 
-## Features
+- Docs: [docs/architecture.md](docs/architecture.md) (diagrams, crypto, rotation program)
+- KNELBMS integration: [docs/integration-knelbms.md](docs/integration-knelbms.md)
+- Redmine: https://projects.knownelement.com/issues/832 (build) / #829 (migration+rotation)
 
-- **Automated Installation**: Automatically detects and installs Bitwarden CLI via multiple methods (snap, npm, direct download)
+## Quick start (lane)
-- **Configuration Management**: Uses secure configuration files for server and authentication details
-- **Multiple Commands**: Support for installation, secret retrieval, listing, and testing
-- **Robust Error Handling**: Comprehensive error codes and detailed logging
-- **Security-First**: Proper session management, cleanup, and credential handling
-- **Cross-Platform**: Designed for Linux environments with multiple installation fallbacks
-
-## Quick Start
-
-1. **Clone and Setup**:
-   ```bash
-   git clone <repository-url>
-   cd KNELSecretsManager
-   chmod +x secrets-manager.sh
-   ```
-
-2. **Create Configuration**:
-   ```bash
-   cp config/bitwarden-config.conf.sample bitwarden-config.conf
-   # Edit bitwarden-config.conf with your actual Bitwarden credentials
-   ```
-
-3. **Install Bitwarden CLI** (if not already installed):
-   ```bash
-   ./secrets-manager.sh install
-   ```
-
-4. **Test Your Setup**:
-   ```bash
-   ./secrets-manager.sh test
-   ```
-
-5. **Retrieve Secrets**:
-   ```bash
-   ./secrets-manager.sh get APIKEY-pushover
-   ```
-
-## Configuration
-
-Create a `bitwarden-config.conf` file based on the provided sample in the `config/` directory:
 
 ```bash
-# Bitwarden server URL
+# TSGCOO account (COO-area chats; docker group, no sudo)
-BW_SERVER_URL="https://pwvault.turnsys.com"
+/data2/TSGCOO/.local/bin/sm status
 
-# API credentials (from Bitwarden account settings)
+# reachableceo crossover
-BW_CLIENTID="your_client_id_here"
+~/projects/KNEL/OAM/.tools/sm env creds/cloudron   # export URI/USERNAME/PASSWORD + keys
-BW_CLIENTSECRET="your_client_secret_here"
+~/projects/KNEL/OAM/.tools/sm get creds/librenms --field password
-
+~/projects/KNEL/OAM/.tools/sm setfield creds/<item> <KEY> <newvalue>   # rotation updates
-# Master password
-BW_PASSWORD="your_master_password_here"
 ```
 
-**Security Note**: The actual configuration file is automatically ignored by git to prevent credential exposure.
+## Layout
 
-## Usage
+| Path | What |
+|---|---|
+| `cli/cmd/smcli/` | the Go CLI (crypto, API, commands) |
+| `docker/Dockerfile.cli` | golang build → alpine runtime (CA certs, non-root) |
+| `docker/compose.yaml` | always-hot service `ukrrs-secretsmgr-cli` (digest-pinned) |
+| `archive/rust-bw-era/` | retired upstream-binary wrapper scripts |
+| `docs/ADR-003-GoCLI.md` | decision record |
 
-### Command Reference
+## Rules (binding)
 
-```bash
+- Secrets live ONLY in the TSGCOO Bitwarden vault, accessed ONLY via this
-./secrets-manager.sh [OPTIONS] COMMAND [ARGS]
+  CLI (container `ukrrs-secretsmgr-cli`, shims above). No textfile creds,
-```
+  no upstream bw CLI — anywhere.
-
+- All work product is authored by Cloudron account identities
-#### Commands
+  (ic-builder / ic-reviewer / manager-tsg / vptechops); the founder
-
+  account (ReachableCEO) reviews and approves.
-- **`install`** - Install Bitwarden CLI
+- Production-affecting rotations follow the CR gating + cross-linking
-- **`get <secret_name>`** - Retrieve a specific secret
+  house rules (GLPI CR deep link in the PR/ticket; evidence on solve).
-- **`list`** - List all available secrets in your vault
-- **`test`** - Test configuration and connectivity
-
-#### Options
-
-- **`-c, --config FILE`** - Use specific config file (default: `./bitwarden-config.conf`)
-- **`-h, --help`** - Show help message
-- **`-v, --version`** - Show version information
-
-### Examples
-
-```bash
-# Install Bitwarden CLI
-./secrets-manager.sh install
-
-# Test your configuration
-./secrets-manager.sh test
-
-# Get a specific secret
-./secrets-manager.sh get APIKEY-pushover
-
-# List all available secrets
-./secrets-manager.sh list
-
-# Use a custom config file
-./secrets-manager.sh --config /path/to/custom.conf get my-secret
-```
-
-### Using in Scripts
-
-```bash
-#!/bin/bash
-# Example: Load API key into environment variable
-export PUSHOVER_API="$(./secrets-manager.sh get APIKEY-pushover)"
-
-# Use the secret in your application
-curl -X POST "https://api.pushover.net/1/messages.json" \
-  -d "token=$PUSHOVER_API" \
-  -d "user=your_user_key" \
-  -d "message=Hello from TSYS!"
-```
-
-## Installation Methods
-
-The script automatically tries multiple installation methods in order:
-
-1. **Snap Package** (if snapd is available)
-2. **NPM Global Package** (if npm is available)
-3. **Direct Binary Download** (fallback method)
-
-## Error Codes
-
-| Code | Description |
-|------|-------------|
-| 10   | Configuration file not found |
-| 20   | Bitwarden CLI not installed |
-| 30   | Bitwarden CLI installation failed |
-| 40   | Server configuration failed |
-| 50   | Session/unlock failed |
-| 60   | Secret not found |
-| 70   | Login failed |
-
-## Logging
-
-All operations are logged to `/tmp/secrets-manager.sh.log` for debugging and audit purposes.
-
-## Security Considerations
-
-- Configuration files containing credentials are automatically gitignored
-- Session tokens are properly cleaned up on script exit
-- Master passwords are handled securely without shell history exposure
-- All sensitive operations include proper error handling
-
-## Legacy Scripts
-
-## Repository Structure
-
-```
-KNELSecretsManager/
-├── secrets-manager.sh           # Main secrets management script
-├── README.md                    # This documentation
-├── LICENSE                      # License information
-├── Makefile                     # Build and test automation
-├── .gitignore                   # Git ignore rules
-├── bin/                        # Legacy scripts and utilities
-│   ├── poc.sh                  # Original proof of concept
-│   └── prod.sh                 # ChatGPT-assisted production attempt
-├── config/                     # Configuration templates
-│   └── bitwarden-config.conf.sample  # Sample configuration
-├── tests/                      # Test suite
-│   └── test-secrets-manager.sh # Comprehensive test framework
-└── docs/                       # Documentation
-    └── ADR-Node.md             # Architecture Decision Records
-```
-
-The main `secrets-manager.sh` script combines the best features of the legacy implementations while adding robust error handling, installation management, and improved security.
-
-## Testing
-
-This project includes a comprehensive test suite designed to work both standalone and when vendored into shell scripting frameworks.
-
-### Running Tests
-
-```bash
-# Run all tests
-./tests/test-secrets-manager.sh run
-
-# Run tests in CI mode (no colors)
-./tests/test-secrets-manager.sh --ci run
-
-# Using Make (recommended)
-make test          # Run all tests
-make test-ci       # Run in CI mode
-make lint          # Run shellcheck
-make all           # Run deps, lint, and tests
-```
-
-### Test Coverage
-
-The test suite covers:
-- Script existence and permissions
-- Command-line argument parsing
-- Help and version output
-- Error handling and exit codes
-- Configuration file validation
-- Bitwarden CLI dependency checks
-- Performance and startup time
-- Vendor integration compatibility
-
-### Vendor Integration Testing
-
-When this project is vendored into other shell scripting frameworks:
-
-```bash
-# Test as vendored dependency
-make vendor-test
-
-# Or manually
-mkdir /tmp/vendor-test
-cp secrets-manager.sh tests/test-secrets-manager.sh config/bitwarden-config.conf.sample /tmp/vendor-test/
-cd /tmp/vendor-test && ./test-secrets-manager.sh --ci run
-```
-
-### Development Testing
-
-```bash
-# Setup development environment
-make dev-setup
-
-# Run tests with development config
-make dev-test
-```
-
-## Architecture Decision Records
-
-This project includes ADRs for key architectural decisions:
-
-- **ADR-001**: [Node.js Version Management Strategy](docs/ADR-Node.md) - Analysis of MISE vs system packages for Node.js version management
-
-## Contributing
-
-When contributing to this project:
-
-1. **Test all changes thoroughly**:
-   ```bash
-   make ci  # Run full CI pipeline
-   ```
-
-2. **Update documentation as needed**
-3. **Follow existing code style and conventions**
-4. **Run security checks**:
-   ```bash
-   make security-check
-   ```
-
-5. **Ensure compatibility with vendor integration**:
-   ```bash
-   make vendor-test
-   ```
-
-## Development Commands
-
-```bash
-make help           # Show all available commands
-make install        # Install dependencies
-make dev-setup      # Setup development environment
-make lint           # Run shellcheck
-make security-check # Basic security validation
-make clean          # Clean temporary files
-make docs           # Generate documentation
-```
-
-## License
-
-See [LICENSE](LICENSE) file for details.

archive/rust-bw-era/bw-cli.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
+#
+# Provides transparent `bw` access on hosts where the CLI is not installed
+# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
+# container (debian-slim + ca-certificates, NO Node.js).
+#
+# All tool execution happens inside the container. Nothing runs on the host
+# except this wrapper, which only invokes docker.
+#
+# Usage:
+#   bw-cli.sh status                 Check vault status
+#   bw-cli.sh list items             List vault items
+#   bw-cli.sh list collections       List collections
+#   bw-cli.sh get password "Item"    Retrieve a password
+#   bw-cli.sh get totp "Item"        Retrieve a TOTP code
+#   bw-cli.sh get item "Item"        Full item JSON
+#   bw-cli.sh generate -ulns         Generate a password
+#
+# Install to ~/.local/bin/bw via:
+#   scripts/bw-install.sh
+#
+# Environment overrides:
+#   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
+#   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
+#   BW_VOLUME     Docker volume for persisted login state
+#                 (default: tsys-bw-cli-state)
+#   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)
+
+set -euo pipefail
+
+BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
+BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
+BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
+BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
+
+# --- Validate prerequisites ---
+if [ ! -f "$BW_ENV_FILE" ]; then
+    echo "bw: credential file not found: $BW_ENV_FILE" >&2
+    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
+    exit 1
+fi
+
+if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
+    echo "bw: Docker image not found: $BW_IMAGE" >&2
+    echo "    build it: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
+    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
+    echo "    install via: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+# --- Load credentials (values are single-quoted in env file) ---
+set -a
+# shellcheck source=/dev/null
+. "$BW_ENV_FILE"
+set +a
+
+# --- Create persistent volume for BW CLI login state ---
+docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
+
+# --- Run bw inside the container ---
+docker run --rm -i \
+    -e BW_CLIENTID \
+    -e BW_CLIENTSECRET \
+    -e BW_PASSWORD \
+    -e BW_SERVER \
+    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
+    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
+    --entrypoint sh \
+    "$BW_IMAGE" \
+    /opt/bw/entrypoint.sh "$@"

archive/rust-bw-era/bw-entrypoint.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
+#
+# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
+# Handles: server config, API-key login, vault unlock, sync.
+# Then execs the real bw command with BW_SESSION set.
+#
+# API key authentication does NOT require TOTP. The API key itself is
+# obtained from an authenticated web vault session, so 2FA is already
+# satisfied at key-generation time.
+#
+# This script intentionally uses /bin/sh (not bash) for minimal container
+# compatibility. shellcheck directive below silences the "not bash" note.
+# shellcheck shell=sh
+
+set -e
+
+BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
+
+# Suppress BW CLI data-dir creation noise and telemetry.
+export BW_NO_SENTRY=true
+
+# --- Step 1: Configure server (fails harmlessly if already logged in) ---
+bw config server "$BW_SERVER" >/dev/null 2>&1 || true
+
+# --- Step 2: Login via API key (silently skips if already authenticated) ---
+bw login --apikey >/dev/null 2>&1 || true
+
+# --- Step 3: Unlock the vault ---
+printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
+SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
+rm -f /tmp/.bwpw
+if [ -z "$SESS" ]; then
+    echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
+    echo "    Values must be single-quoted; \$ chars get mangled if unquoted." >&2
+    exit 1
+fi
+
+# --- Step 4: Sync ---
+bw sync --session "$SESS" >/dev/null 2>&1 || true
+
+# --- Step 5: Execute the requested command ---
+export BW_SESSION="$SESS"
+exec bw "$@"

archive/rust-bw-era/bw-install.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# bw-install.sh — Install the container-based Bitwarden CLI wrapper.
+#
+# Downloads the native Rust bw binary, builds the Docker image, and installs
+# the host-side wrapper plus container entrypoint to the user's local paths.
+# No Node.js is involved at any layer.
+#
+# Usage:
+#   bw-install.sh                Download, build, and install everything
+#   bw-install.sh --check        Verify installation status without changes
+#
+# Prerequisites:
+#   - docker on PATH
+#   - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS)
+#
+# After install, ~/.local/bin/bw provides transparent CLI access. Add
+# ~/.local/bin to PATH if not already (most distros do this via ~/.profile).
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$HERE/.." && pwd)"
+
+BW_VERSION="2026.7.0"
+BW_IMAGE="reachableceo-bw-native:${BW_VERSION}"
+BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip"
+
+INSTALL_BIN="${HOME}/.local/bin"
+INSTALL_LIB="${HOME}/.local/share/bw"
+BUILD_DIR=""
+
+# --- Helpers ---
+log_info()  { printf '\033[0;34m›\033[0m %s\n' "$*"; }
+log_ok()    { printf '\033[0;32m✓\033[0m %s\n' "$*"; }
+log_warn()  { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; }
+log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; }
+log_step()  { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }
+die()       { log_error "$*"; exit 1; }
+
+# --- Cleanup on exit ---
+cleanup() {
+    [ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR"
+}
+trap cleanup EXIT
+
+# --- Check mode ---
+if [ "${1:-}" = "--check" ]; then
+    log_step "BW CLI installation check"
+    if command -v docker >/dev/null 2>&1; then
+        log_ok "docker on PATH"
+    else
+        log_error "docker not on PATH"
+    fi
+    if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
+        log_ok "Docker image ${BW_IMAGE} exists"
+    else
+        log_error "Docker image ${BW_IMAGE} missing"
+    fi
+    if [ -x "${INSTALL_BIN}/bw" ]; then
+        log_ok "Host wrapper at ${INSTALL_BIN}/bw"
+    else
+        log_error "Host wrapper at ${INSTALL_BIN}/bw missing"
+    fi
+    if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then
+        log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh"
+    else
+        log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing"
+    fi
+    exit 0
+fi
+
+# --- Prerequisites ---
+command -v docker >/dev/null 2>&1 || die "docker not found on PATH"
+
+log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)"
+
+# --- Step 1: Download and extract the native binary ---
+BUILD_DIR=$(mktemp -d)
+log_info "Downloading bw ${BW_VERSION} native binary..."
+
+docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \
+    sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \
+           wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \
+           unzip -o /build/bw.zip -d /build/ && \
+           rm /build/bw.zip && \
+           chmod +x /build/bw"
+
+[ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found"
+log_ok "Downloaded native binary"
+
+# --- Step 2: Build the Docker image ---
+log_info "Building Docker image ${BW_IMAGE}..."
+
+DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native"
+if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then
+    die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile"
+fi
+
+cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw"
+docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR"
+rm -f "${DOCKERFILE_DIR}/bw"
+log_ok "Built image ${BW_IMAGE}"
+
+# --- Step 3: Install host-side wrapper and entrypoint ---
+mkdir -p "$INSTALL_BIN" "$INSTALL_LIB"
+
+cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw"
+chmod 755 "${INSTALL_BIN}/bw"
+log_ok "Installed wrapper to ${INSTALL_BIN}/bw"
+
+cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh"
+chmod 755 "${INSTALL_LIB}/entrypoint.sh"
+log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh"
+
+# --- Step 4: Verify ---
+log_info "Verifying installation..."
+if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then
+    log_ok "bw CLI is operational"
+else
+    log_warn "bw wrapper installed but verification call failed"
+    log_warn "check ~/.config/bw/env credentials and try: bw status"
+fi
+
+log_step "Installation complete"
+log_info "Usage: bw status | bw list items | bw get password \"Item Name\""

cli/.gitignore

@@ -0,0 +1 @@
+.smstate/

cli/cmd/smcli/api.go

@@ -0,0 +1,289 @@
+package main
+
+// Vaultwarden/Bitwarden API client: prelogin, login, sync, cipher create/edit.
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+)
+
+type Client struct {
+	Server   string // e.g. https://pwvault.turnsys.com
+	HTTP     *http.Client
+	Email    string
+	Password string
+
+	AccessToken  string
+	KDFType      int
+	KDFIter      uint32
+	KDFMemory    uint32
+	KDFParallel  uint32
+	MasterKey    []byte // 32B
+	StretchedKey []byte // 64B
+	UserSymKey   []byte // 64B (decrypted from profile.Key)
+}
+
+func (c *Client) api(method, path string, body any, auth bool) ([]byte, error) {
+	var rd io.Reader
+	if body != nil {
+		switch b := body.(type) {
+		case url.Values:
+			rd = strings.NewReader(b.Encode())
+		default:
+			j, err := json.Marshal(body)
+			if err != nil {
+				return nil, err
+			}
+			rd = bytes.NewReader(j)
+		}
+	} else {
+		rd = strings.NewReader("")
+	}
+	req, err := http.NewRequest(method, c.Server+path, rd)
+	if err != nil {
+		return nil, err
+	}
+	if body != nil {
+		if _, ok := body.(url.Values); ok {
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		} else {
+			req.Header.Set("Content-Type", "application/json")
+		}
+	}
+	if auth {
+		req.Header.Set("Authorization", "Bearer "+c.AccessToken)
+	}
+	resp, err := c.HTTP.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	out, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode >= 300 {
+		return out, fmt.Errorf("%s %s: HTTP %d: %s", method, path, resp.StatusCode, truncate(string(out), 200))
+	}
+	return out, nil
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n] + "..."
+}
+
+type preloginResp struct {
+	KDF            int    `json:"kdf"`
+	KDFIterations  uint32 `json:"kdfIterations"`
+	KDFMemory      uint32 `json:"kdfMemory"`
+	KDFParallelism uint32 `json:"kdfParallelism"`
+}
+
+func (c *Client) Prelogin() error {
+	out, err := c.api("POST", "/api/accounts/prelogin", map[string]string{"email": c.Email}, false)
+	if err != nil {
+		return err
+	}
+	var p preloginResp
+	if err := json.Unmarshal(out, &p); err != nil {
+		return err
+	}
+	c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel = p.KDF, p.KDFIterations, p.KDFMemory, p.KDFParallelism
+	return nil
+}
+
+type tokenResp struct {
+	AccessToken string `json:"access_token"`
+	RefreshTok  string `json:"refresh_token"`
+	Key         string `json:"Key"`
+	PrivateKey  string `json:"PrivateKey"`
+	ErrorDesc   string `json:"ErrorDescription"`
+}
+
+// Login performs prelogin + key derivation + password grant.
+func (c *Client) Login() error {
+	if err := c.Prelogin(); err != nil {
+		return fmt.Errorf("prelogin: %w", err)
+	}
+	c.MasterKey = deriveMasterKey(c.Password, c.Email, c.KDFType, c.KDFIter, c.KDFMemory, c.KDFParallel)
+	c.StretchedKey = stretchKey(c.MasterKey)
+
+	form := url.Values{}
+	form.Set("grant_type", "password")
+	form.Set("username", c.Email)
+	form.Set("password", masterPasswordHash(c.MasterKey, c.Password))
+	form.Set("scope", "api offline_access")
+	form.Set("client_id", "cli")
+	form.Set("deviceIdentifier", deviceID())
+	form.Set("deviceName", "smcli")
+	form.Set("deviceType", "9")
+	var lastOut []byte
+	out, err := c.apiRaw("POST", "/identity/connect/token", form, false)
+	if err != nil {
+		return fmt.Errorf("token: %w", err)
+	}
+	var t tokenResp
+	if err := json.Unmarshal(out, &t); err != nil {
+		return err
+	}
+	if t.AccessToken == "" {
+		// 2FA retry path (provider 0 = authenticator TOTP)
+		if strings.Contains(string(out), "Two factor required") {
+			secret := os.Getenv("SM_TOTP_SECRET")
+			if secret != "" {
+				code, terr := totpNow(secret, time.Now())
+				if terr != nil {
+					return fmt.Errorf("totp: %w", terr)
+				}
+				form.Set("twoFactor", "0")
+				form.Set("twoFactorProvider", "0")
+				form.Set("twoFactorToken", code)
+				form.Set("twoFactorRemember", "1")
+				out2, err2 := c.api("POST", "/identity/connect/token", form, false)
+				if err2 != nil {
+					return fmt.Errorf("token(2fa): %w", err2)
+				}
+				if err := json.Unmarshal(out2, &t); err != nil {
+					return err
+				}
+				lastOut = out2
+			}
+		}
+	}
+	if t.AccessToken == "" {
+		payload := string(out)
+		if lastOut != nil {
+			payload = string(lastOut)
+		}
+		return fmt.Errorf("login failed: %s", truncate(payload, 300))
+	}
+	c.AccessToken = t.AccessToken
+	return nil
+}
+
+type syncResp struct {
+	Profile struct {
+		Key        string `json:"key"`
+		PrivateKey string `json:"privateKey"`
+		Email      string `json:"email"`
+	} `json:"profile"`
+	Folders []struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	} `json:"folders"`
+	Ciphers []json.RawMessage `json:"ciphers"`
+}
+
+// Unlock performs sync-light: fetches profile key, decrypts the user sym key.
+func (c *Client) Unlock() error {
+	out, err := c.api("GET", "/api/sync?excludeDomains=true", nil, true)
+	if err != nil {
+		return err
+	}
+	var s syncResp
+	if err := json.Unmarshal(out, &s); err != nil {
+		return err
+	}
+	if s.Profile.Key == "" {
+		return errors.New("sync: empty profile key")
+	}
+	es, err := ParseEncString(s.Profile.Key)
+	if err != nil {
+		return err
+	}
+	c.UserSymKey, err = symDecrypt(c.StretchedKey, es)
+	if err != nil {
+		return fmt.Errorf("decrypt user key: %w", err)
+	}
+	return nil
+}
+
+// Sync returns the raw sync payload (cached by caller as needed).
+func (c *Client) Sync() ([]byte, error) {
+	return c.api("GET", "/api/sync?excludeDomains=true", nil, true)
+}
+
+// CreateCipher posts an encrypted cipher.
+func (c *Client) CreateCipher(cipherJSON any) ([]byte, error) {
+	return c.api("POST", "/api/ciphers", cipherJSON, true)
+}
+
+// EditCipher updates an encrypted cipher.
+func (c *Client) EditCipher(id string, cipherJSON any) ([]byte, error) {
+	return c.api("PUT", "/api/ciphers/"+id, cipherJSON, true)
+}
+
+func deviceID() string {
+	// stable per machine: hash of hostname (no secrets involved)
+	hn := hostnameSafe()
+	sum := sha256Sum([]byte("knel-secretsmgr:" + hn))
+	var b [16]byte
+	copy(b[:], sum[:16])
+	return fmt.Sprintf("%08x-%04x-%04x-%04x-%012x",
+		binary.BigEndian.Uint32(b[0:4]),
+		binary.BigEndian.Uint16(b[4:6]),
+		binary.BigEndian.Uint16(b[6:8]),
+		binary.BigEndian.Uint16(b[8:10]),
+		b[10:16])
+}
+
+// apiRaw performs the request and returns the body regardless of status.
+func (c *Client) apiRaw(method, path string, body any, auth bool) ([]byte, error) {
+	var rd io.Reader
+	if body != nil {
+		switch b := body.(type) {
+		case url.Values:
+			rd = strings.NewReader(b.Encode())
+		default:
+			j, err := json.Marshal(body)
+			if err != nil {
+				return nil, err
+			}
+			rd = bytes.NewReader(j)
+		}
+	} else {
+		rd = strings.NewReader("")
+	}
+	req, err := http.NewRequest(method, c.Server+path, rd)
+	if err != nil {
+		return nil, err
+	}
+	if body != nil {
+		if _, ok := body.(url.Values); ok {
+			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		} else {
+			req.Header.Set("Content-Type", "application/json")
+		}
+	}
+	if auth {
+		req.Header.Set("Authorization", "Bearer "+c.AccessToken)
+	}
+	resp, err := c.HTTP.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	return io.ReadAll(resp.Body)
+}
+
+// DeleteCipher moves a cipher to trash (soft delete). Best-effort permanent
+// purge afterwards; Vaultwarden tolerates trash-only items.
+func (c *Client) DeleteCipher(id string) error {
+	if _, err := c.api("DELETE", "/api/ciphers/"+id, nil, true); err != nil {
+		return err
+	}
+	_, _ = c.api("PUT", "/api/ciphers/"+id+"/purge", map[string]any{}, true)
+	return nil
+}

cli/cmd/smcli/crypto.go

@@ -0,0 +1,204 @@
+package main
+
+// Bitwarden-compatible crypto for the KNELSecretsManager CLI (Vaultwarden API).
+//   - master key: PBKDF2-SHA256(password, email, iterations, 32B) or Argon2id
+//   - auth: masterPasswordHash = base64(PBKDF2-SHA256(masterKey, password, 1, 32B))
+//   - stretched master key: HKDF-SHA256 expand, info "enc"/"mac" (32B each)
+//   - encString "2.iv|ct|mac": AES-256-CBC(encKey32) + HMAC-SHA256(macKey32, iv||ct)
+//     ("AesCbc128_HmacSha256_B64" is Bitwarden's legacy misnomer; keys are 32+32 bytes)
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"golang.org/x/crypto/argon2"
+	"golang.org/x/crypto/pbkdf2"
+)
+
+type EncString struct {
+	Type byte
+	IV   []byte
+	CT   []byte
+	MAC  []byte
+}
+
+func ParseEncString(s string) (*EncString, error) {
+	if s == "" {
+		return nil, errors.New("empty encstring")
+	}
+	parts := strings.SplitN(s, ".", 2)
+	if len(parts) != 2 {
+		return nil, errors.New("encstring missing type header")
+	}
+	t, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return nil, fmt.Errorf("bad encstring type: %w", err)
+	}
+	es := &EncString{Type: byte(t)}
+	switch t {
+	case 0: // AesCbc256_B64 (legacy, no mac)
+		b, err := base64.StdEncoding.DecodeString(parts[1])
+		if err != nil {
+			return nil, err
+		}
+		es.IV, es.CT = b[:16], b[16:]
+	case 1, 2: // both handled identically on the wire (enc32+mac32 keys)
+		seg := strings.Split(parts[1], "|")
+		if len(seg) != 3 {
+			return nil, errors.New("encstring needs iv|ct|mac")
+		}
+		if es.IV, err = base64.StdEncoding.DecodeString(seg[0]); err != nil {
+			return nil, err
+		}
+		if es.CT, err = base64.StdEncoding.DecodeString(seg[1]); err != nil {
+			return nil, err
+		}
+		if es.MAC, err = base64.StdEncoding.DecodeString(seg[2]); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("unsupported encstring type %d", t)
+	}
+	return es, nil
+}
+
+func (e *EncString) String() string {
+	if e.Type == 0 {
+		return "0." + base64.StdEncoding.EncodeToString(append(append([]byte{}, e.IV...), e.CT...))
+	}
+	return fmt.Sprintf("%d.%s|%s|%s", e.Type,
+		base64.StdEncoding.EncodeToString(e.IV),
+		base64.StdEncoding.EncodeToString(e.CT),
+		base64.StdEncoding.EncodeToString(e.MAC))
+}
+
+func deriveMasterKey(password, email string, kdfType int, iterations, memory, parallelism uint32) []byte {
+	salt := []byte(strings.ToLower(strings.TrimSpace(email)))
+	switch kdfType {
+	case 1:
+		return argon2.IDKey([]byte(password), salt, iterations, memory, uint8(parallelism), 32)
+	default:
+		return pbkdf2.Key([]byte(password), salt, int(iterations), 32, sha256.New)
+	}
+}
+
+func masterPasswordHash(masterKey []byte, password string) string {
+	return base64.StdEncoding.EncodeToString(pbkdf2.Key(masterKey, []byte(password), 1, 32, sha256.New))
+}
+
+// stretchKey expands the 32B master key to a 64B symmetric key (enc 32 | mac 32).
+func stretchKey(masterKey []byte) []byte {
+	out := make([]byte, 64)
+	copy(out[:32], hkdfExpand(masterKey, []byte("enc"), 32))
+	copy(out[32:], hkdfExpand(masterKey, []byte("mac"), 32))
+	return out
+}
+
+func hkdfExpand(key, info []byte, length int) []byte {
+	out := make([]byte, 0, length)
+	t := []byte{}
+	var i byte
+	for len(out) < length {
+		i++
+		h := hmac.New(sha256.New, key)
+		h.Write(t)
+		h.Write(info)
+		h.Write([]byte{i})
+		t = h.Sum(nil)
+		out = append(out, t...)
+	}
+	return out[:length]
+}
+
+// symDecrypt decrypts a type-1/2 encstring with a 64-byte key (enc32|mac32).
+func symDecrypt(key64 []byte, es *EncString) ([]byte, error) {
+	if len(key64) != 64 {
+		return nil, errors.New("symmetric key must be 64 bytes")
+	}
+	if es.Type == 0 {
+		return aesCBCDecrypt(key64[:32], es.IV, es.CT)
+	}
+	if es.Type != 1 && es.Type != 2 {
+		return nil, fmt.Errorf("unsupported encstring type %d", es.Type)
+	}
+	mac := hmac.New(sha256.New, key64[32:])
+	mac.Write(es.IV)
+	mac.Write(es.CT)
+	if subtle.ConstantTimeCompare(mac.Sum(nil), es.MAC) != 1 {
+		return nil, errors.New("mac mismatch")
+	}
+	return aesCBCDecrypt(key64[:32], es.IV, es.CT)
+}
+
+// symEncrypt encrypts plaintext into a type-2 encstring with a 64-byte key.
+func symEncrypt(key64 []byte, plaintext []byte) (string, error) {
+	if len(key64) != 64 {
+		return "", errors.New("symmetric key must be 64 bytes")
+	}
+	iv := make([]byte, 16)
+	if _, err := rand.Read(iv); err != nil {
+		return "", err
+	}
+	ct, err := aesCBCEncrypt(key64[:32], iv, plaintext)
+	if err != nil {
+		return "", err
+	}
+	mac := hmac.New(sha256.New, key64[32:])
+	mac.Write(iv)
+	mac.Write(ct)
+	es := &EncString{Type: 2, IV: iv, CT: ct, MAC: mac.Sum(nil)}
+	return es.String(), nil
+}
+
+func aesCBCDecrypt(key, iv, ct []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	if len(ct) == 0 || len(ct)%aes.BlockSize != 0 {
+		return nil, errors.New("ciphertext not block aligned")
+	}
+	pt := make([]byte, len(ct))
+	cipher.NewCBCDecrypter(block, iv).CryptBlocks(pt, ct)
+	return unpad(pt)
+}
+
+func aesCBCEncrypt(key, iv, pt []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	ct := make([]byte, len(pad(pt)))
+	cipher.NewCBCEncrypter(block, iv).CryptBlocks(ct, pad(pt))
+	return ct, nil
+}
+
+func unpad(b []byte) ([]byte, error) {
+	if len(b) == 0 {
+		return nil, errors.New("empty plaintext")
+	}
+	n := int(b[len(b)-1])
+	if n == 0 || n > aes.BlockSize || n > len(b) {
+		return nil, errors.New("bad padding")
+	}
+	return b[:len(b)-n], nil
+}
+
+func pad(b []byte) []byte {
+	n := aes.BlockSize - len(b)%aes.BlockSize
+	out := make([]byte, len(b)+n)
+	copy(out, b)
+	for i := len(b); i < len(out); i++ {
+		out[i] = byte(n)
+	}
+	return out
+}

cli/cmd/smcli/main.go

@@ -0,0 +1,650 @@
+package main
+
+// smcli — KNELSecretsManager Go CLI (pure Go; replaces the upstream Rust bw binary).
+// Speaks the Bitwarden/Vaultwarden API against the self-hosted vault.
+//
+// Commands:
+//   login                          authenticate (SM_EMAIL/SM_PASSWORD/SM_SERVER env or flags)
+//   status                         show auth/key state
+//   list [pattern]                 list item names
+//   get <name> [--field KEY]       print decrypted item (or one field / KEY=VALUE block)
+//   env <name>                     print KEY=VALUE lines for `eval`/sourcing
+//   set <name> [k=v ...]           create/update a secure-note item from --file or inline k=v
+//   rm <name>                      delete item
+//   folders                        list folders
+//
+// State: SM_STATE_DIR (default ~/.config/smcli), files 0600.
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const stateVersion = 1
+
+type State struct {
+	Version     int    `json:"version"`
+	Server      string `json:"server"`
+	Email       string `json:"email"`
+	AccessToken string `json:"access_token"`
+	KDFType     int    `json:"kdf_type"`
+	KDFIter     uint32 `json:"kdf_iter"`
+	KDFMemory   uint32 `json:"kdf_memory"`
+	KDFParallel uint32 `json:"kdf_parallel"`
+	// MasterKey/StretchedKey/UserSymKey stored raw (hex) — file must be 0600.
+	MasterKey    string `json:"master_key"`
+	StretchedKey string `json:"stretched_key"`
+	UserSymKey   string `json:"user_sym_key"`
+}
+
+func stateDir() string {
+	if v := os.Getenv("SM_STATE_DIR"); v != "" {
+		return v
+	}
+	home, _ := os.UserHomeDir()
+	return filepath.Join(home, ".config", "smcli")
+}
+
+func statePath() string { return filepath.Join(stateDir(), "state.json") }
+
+func saveState(s *State) error {
+	if err := os.MkdirAll(stateDir(), 0o700); err != nil {
+		return err
+	}
+	b, err := json.Marshal(s)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(statePath(), b, 0o600)
+}
+
+func loadState() (*State, error) {
+	b, err := os.ReadFile(statePath())
+	if err != nil {
+		return nil, err
+	}
+	var s State
+	if err := json.Unmarshal(b, &s); err != nil {
+		return nil, err
+	}
+	if s.Version != stateVersion {
+		return nil, errors.New("state version mismatch; re-login")
+	}
+	return &s, nil
+}
+
+func newClientFromState(s *State) (*Client, error) {
+	c := &Client{
+		Server: s.Server, Email: s.Email,
+		AccessToken: s.AccessToken,
+		KDFType:     s.KDFType, KDFIter: s.KDFIter, KDFMemory: s.KDFMemory, KDFParallel: s.KDFParallel,
+		HTTP: &http.Client{Timeout: 30 * time.Second},
+	}
+	var err error
+	if c.MasterKey, err = fromHex(s.MasterKey); err != nil {
+		return nil, err
+	}
+	if c.StretchedKey, err = fromHex(s.StretchedKey); err != nil {
+		return nil, err
+	}
+	if c.UserSymKey, err = fromHex(s.UserSymKey); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+func cmdLogin(server, email, password string) error {
+	c := &Client{Server: server, Email: email, Password: password,
+		HTTP: &http.Client{Timeout: 30 * time.Second}}
+	if err := c.Login(); err != nil {
+		return err
+	}
+	s := &State{
+		Version: stateVersion, Server: server, Email: email,
+		AccessToken: c.AccessToken,
+		KDFType:     c.KDFType, KDFIter: c.KDFIter, KDFMemory: c.KDFMemory, KDFParallel: c.KDFParallel,
+		MasterKey:    toHex(c.MasterKey),
+		StretchedKey: toHex(c.StretchedKey),
+	}
+	if err := saveState(s); err != nil {
+		return err
+	}
+	// immediately decrypt the user sym key
+	if err := c.Unlock(); err != nil {
+		return err
+	}
+	s.UserSymKey = toHex(c.UserSymKey)
+	return saveState(s)
+}
+
+func cmdList(pattern string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	raw, err := c.Sync()
+	if err != nil {
+		return err
+	}
+	var sync struct {
+		Ciphers []json.RawMessage `json:"ciphers"`
+	}
+	if err := json.Unmarshal(raw, &sync); err != nil {
+		return err
+	}
+	for _, r := range sync.Ciphers {
+		pc, err := DecryptCipher(c.UserSymKey, r)
+		if err != nil {
+			continue
+		}
+		if pattern == "" || strings.Contains(strings.ToLower(pc.Name), strings.ToLower(pattern)) {
+			fmt.Println(pc.Name)
+		}
+	}
+	return nil
+}
+
+func findCipher(c *Client, userKey []byte, name string) (*PlainCipher, json.RawMessage, error) {
+	raw, err := c.Sync()
+	if err != nil {
+		return nil, nil, err
+	}
+	var sync struct {
+		Ciphers []json.RawMessage `json:"ciphers"`
+	}
+	if err := json.Unmarshal(raw, &sync); err != nil {
+		return nil, nil, err
+	}
+	for _, r := range sync.Ciphers {
+		pc, err := DecryptCipher(userKey, r)
+		if err != nil || pc.Name != name {
+			continue
+		}
+		return pc, r, nil
+	}
+	return nil, nil, errors.New("item not found: " + name)
+}
+
+func rawCipherByID(raw []byte, id string) (*cipherRaw, error) {
+	var sync struct {
+		Ciphers []json.RawMessage `json:"ciphers"`
+	}
+	if err := json.Unmarshal(raw, &sync); err != nil {
+		return nil, err
+	}
+	for _, r := range sync.Ciphers {
+		var cr cipherRaw
+		if err := json.Unmarshal(r, &cr); err != nil {
+			continue
+		}
+		if cr.ID == id {
+			return &cr, nil
+		}
+	}
+	return nil, errors.New("cipher id not found: " + id)
+}
+
+func cmdGet(name, field string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	pc, _, err := findCipher(c, c.UserSymKey, name)
+	if err != nil {
+		return err
+	}
+	if field != "" {
+		for _, f := range pc.Fields {
+			if f.Name == field {
+				fmt.Println(f.Value)
+				return nil
+			}
+		}
+		if field == "password" {
+			fmt.Println(pc.Login.Password)
+			return nil
+		}
+		if field == "username" {
+			fmt.Println(pc.Login.Username)
+			return nil
+		}
+		if field == "notes" {
+			fmt.Print(pc.Notes)
+			return nil
+		}
+		return fmt.Errorf("field not found: %s", field)
+	}
+	out, _ := json.MarshalIndent(pc, "", "  ")
+	fmt.Println(string(out))
+	return nil
+}
+
+func cmdEnv(name string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	pc, _, err := findCipher(c, c.UserSymKey, name)
+	if err != nil {
+		return err
+	}
+	for _, f := range pc.Fields {
+		v := strings.ReplaceAll(f.Value, "'", "'\\''")
+		fmt.Printf("export %s='%s'\n", f.Name, v)
+	}
+	if len(pc.URIs) > 0 {
+		fmt.Printf("export URI='%s'\n", pc.URIs[0])
+	}
+	if pc.Login.Username != "" {
+		fmt.Printf("export USERNAME='%s'\n", pc.Login.Username)
+	}
+	if pc.Login.Password != "" {
+		fmt.Printf("export PASSWORD='%s'\n", pc.Login.Password)
+	}
+	return nil
+}
+
+func cmdSet(name, file string, kv []string, folderID string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	var fields []PlainField
+	if file != "" {
+		b, err := os.ReadFile(file)
+		if err != nil {
+			return err
+		}
+		fields = parseEnvFields(string(b))
+	}
+	for _, kv := range kv {
+		eq := strings.Index(kv, "=")
+		if eq <= 0 {
+			return fmt.Errorf("bad k=v: %s", kv)
+		}
+		fields = append(fields, PlainField{Type: 1, Name: kv[:eq], Value: kv[eq+1:]})
+	}
+	raw, err := c.Sync()
+	if err != nil {
+		return err
+	}
+	pc, _, err := findCipher(c, c.UserSymKey, name)
+	exists := err == nil
+	var payload map[string]any
+	if exists {
+		var cr *cipherRaw
+		cr, err = rawCipherByID(raw, pc.ID)
+		if err != nil {
+			return err
+		}
+		payload, err = BuildSecureNoteJSON(c.UserSymKey, name, folderID, pc.Notes, fields, cr)
+		if err != nil {
+			return err
+		}
+		_, err = c.EditCipher(pc.ID, payload)
+	} else {
+		payload, err = BuildSecureNoteJSON(c.UserSymKey, name, folderID, "", fields, nil)
+		if err != nil {
+			return err
+		}
+		_, err = c.CreateCipher(payload)
+	}
+	if err != nil {
+		return err
+	}
+	fmt.Println("ok:", name)
+	return nil
+}
+
+func cmdRm(name string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	pc, raw, err := findCipher(c, c.UserSymKey, name)
+	if err != nil {
+		return err
+	}
+	var parsed map[string]any
+	_ = json.Unmarshal(raw, &parsed)
+	id, _ := parsed["id"].(string)
+	_ = pc
+	fmt.Println("deleted:", name)
+	return c.DeleteCipher(id)
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(1)
+	}
+	var err error
+	switch os.Args[1] {
+	case "login":
+		fs := flag.NewFlagSet("login", flag.ExitOnError)
+		server := fs.String("server", envOr("SM_SERVER", "https://pwvault.turnsys.com"), "vault server")
+		email := fs.String("email", os.Getenv("SM_EMAIL"), "account email")
+		password := fs.String("password", os.Getenv("SM_PASSWORD"), "master password (prefer env)")
+		_ = fs.Parse(os.Args[2:])
+		if *email == "" || *password == "" {
+			fatal("login needs SM_EMAIL and SM_PASSWORD (or -email/-password)")
+		}
+		err = cmdLogin(*server, *email, *password)
+	case "status":
+		s, e := loadState()
+		if e != nil {
+			fmt.Println("locked/absent:", e)
+			return
+		}
+		fmt.Printf("server=%s email=%s unlocked=%v\n", s.Server, s.Email, s.UserSymKey != "")
+	case "list":
+		pat := ""
+		if len(os.Args) > 2 {
+			pat = os.Args[2]
+		}
+		err = cmdList(pat)
+	case "get":
+		if len(os.Args) < 3 {
+			fatal("get <name> [--field KEY]")
+		}
+		field := ""
+		for i, a := range os.Args {
+			if a == "--field" && i+1 < len(os.Args) {
+				field = os.Args[i+1]
+			}
+		}
+		err = cmdGet(os.Args[2], field)
+	case "env":
+		if len(os.Args) < 3 {
+			fatal("env <name>")
+		}
+		err = cmdEnv(os.Args[2])
+	case "set":
+		fs := flag.NewFlagSet("set", flag.ExitOnError)
+		file := fs.String("file", "", "env file with KEY=VALUE lines")
+		folder := fs.String("folder", "", "folder id")
+		_ = fs.Parse(os.Args[2:])
+		rest := fs.Args()
+		if len(rest) < 1 {
+			fatal("set <name> [--file F] [k=v ...]")
+		}
+		err = cmdSet(rest[0], *file, rest[1:], *folder)
+	case "rm":
+		if len(os.Args) < 3 {
+			fatal("rm <name>")
+		}
+		err = cmdRm(os.Args[2])
+	case "folders":
+		s, e := loadState()
+		if e != nil {
+			fatal(e)
+		}
+		c, e := newClientFromState(s)
+		if e != nil {
+			fatal(e)
+		}
+		raw, e := c.Sync()
+		if e != nil {
+			fatal(e)
+		}
+		var sync struct {
+			Folders []struct {
+				ID   string `json:"id"`
+				Name string `json:"name"`
+			} `json:"folders"`
+		}
+		_ = json.Unmarshal(raw, &sync)
+		for _, f := range sync.Folders {
+			fmt.Println(f.ID, f.Name)
+		}
+	case "setfield":
+		if len(os.Args) < 5 {
+			fatal("setfield <name> <key> <value>")
+		}
+		err = cmdSetField(os.Args[2], os.Args[3], os.Args[4])
+	case "convert":
+		if len(os.Args) < 3 {
+			fatal("convert <name>")
+		}
+		err = cmdConvert(os.Args[2])
+	default:
+		usage()
+		os.Exit(1)
+	}
+	if err != nil {
+		fatal(err)
+	}
+}
+
+func envOr(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}
+
+func fatal(v any) {
+	fmt.Fprintln(os.Stderr, "smcli:", v)
+	os.Exit(1)
+}
+
+func usage() {
+	fmt.Fprint(os.Stderr, `smcli — KNELSecretsManager Go CLI (Bitwarden/Vaultwarden)
+  login                        authenticate (SM_EMAIL/SM_PASSWORD/SM_SERVER)
+  status                       auth/key state
+  list [pattern]               list item names
+  get <name> [--field KEY]     decrypt item / field
+  env <name>                   print export KEY='VALUE' lines (sourcable)
+  set <name> [--file F] k=v    create/update secure note with hidden fields
+  rm <name>                    delete item
+  folders                      list folders
+`)
+}
+
+// classifyCreds maps lifted env fields to login-item structure.
+func classifyCreds(fields []PlainField) (username, password string, uris []string, rest []PlainField) {
+	used := map[int]bool{}
+	pick := func(res []string) (PlainField, bool) {
+		for i, f := range fields {
+			if used[i] {
+				continue
+			}
+			up := strings.ToUpper(f.Name)
+			for _, re := range res {
+				if strings.Contains(up, re) && f.Value != "" {
+					used[i] = true
+					return f, true
+				}
+			}
+		}
+		return PlainField{}, false
+	}
+	if f, ok := pick([]string{"USERNAME", "USER", "EMAIL", "LOGIN", "AUTH_ID"}); ok {
+		username = f.Value
+	}
+	if f, ok := pick([]string{"PASSWORD", "PASS", "TOKEN", "SECRET", "APIKEY", "API_KEY", "KEY", "HASH", "REFRESH"}); ok {
+		password = f.Value
+	}
+	for i, f := range fields {
+		up := strings.ToUpper(f.Name)
+		if !used[i] && (strings.HasSuffix(up, "URL") || strings.HasSuffix(up, "URI") || strings.HasSuffix(up, "DASH") || strings.Contains(up, "ENDPOINT")) && f.Value != "" {
+			used[i] = true
+			uris = append(uris, f.Value)
+		}
+	}
+	for i, f := range fields {
+		if used[i] || f.Value == "" {
+			continue
+		}
+		up := strings.ToUpper(f.Name)
+		hidden := strings.Contains(up, "PASS") || strings.Contains(up, "TOKEN") || strings.Contains(up, "SECRET") || strings.Contains(up, "KEY") || strings.Contains(up, "HASH")
+		t := 0
+		if hidden {
+			t = 1
+		}
+		rest = append(rest, PlainField{Type: t, Name: f.Name, Value: f.Value})
+	}
+	return
+}
+
+func cmdConvert(name string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	pc, raw, err := findCipher(c, c.UserSymKey, name)
+	if err != nil {
+		return err
+	}
+	all := append([]PlainField{}, pc.Fields...)
+	var folderID string
+	var parsed map[string]any
+	_ = json.Unmarshal(raw, &parsed)
+	if v, ok := parsed["folderId"].(string); ok {
+		folderID = v
+	}
+	username, password, uris, rest := classifyCreds(all)
+	payload, err := BuildLoginJSON(c.UserSymKey, name, folderID, username, password, uris, rest, nil)
+	if err != nil {
+		return err
+	}
+	if _, err := c.CreateCipher(payload); err != nil {
+		return err
+	}
+	// remove the old note
+	var parsedOld map[string]any
+	_ = json.Unmarshal(raw, &parsedOld)
+	if id, ok := parsedOld["id"].(string); ok {
+		_ = c.DeleteCipher(id)
+	}
+	fmt.Printf("converted: %s (user=%v pass=%v uris=%d fields=%d)\n", name, username != "", password != "", len(uris), len(rest))
+	return nil
+}
+
+func urisOf(pc *PlainCipher) []string { return pc.URIs }
+
+// cmdSetField surgically updates one key on an existing item: login.password,
+// login.username, an existing custom field, or appends a new hidden field.
+func cmdSetField(name, key, value string) error {
+	s, err := loadState()
+	if err != nil {
+		return err
+	}
+	c, err := newClientFromState(s)
+	if err != nil {
+		return err
+	}
+	raw, err := c.Sync()
+	if err != nil {
+		return err
+	}
+	var sync struct {
+		Ciphers []json.RawMessage `json:"ciphers"`
+	}
+	if err := json.Unmarshal(raw, &sync); err != nil {
+		return err
+	}
+	var cr *cipherRaw
+	for _, r := range sync.Ciphers {
+		var x cipherRaw
+		if json.Unmarshal(r, &x) == nil && x.ID != "" {
+			pc2, derr := DecryptCipher(c.UserSymKey, r)
+			if derr == nil && pc2.Name == name {
+				cr = &x
+				break
+			}
+		}
+	}
+	if cr == nil {
+		return fmt.Errorf("item not found: %s", name)
+	}
+	ck, err := cipherKeyFor(c.UserSymKey, cr.Key)
+	if err != nil {
+		return err
+	}
+	switch strings.ToLower(key) {
+	case "password":
+		p, err := encStr(c.UserSymKey, value)
+		if err != nil {
+			return err
+		}
+		if cr.Login == nil {
+			cr.Login = &CipherLogin{}
+		}
+		cr.Login.Password = &p
+	case "username":
+		p, err := encStr(c.UserSymKey, value)
+		if err != nil {
+			return err
+		}
+		if cr.Login == nil {
+			cr.Login = &CipherLogin{}
+		}
+		cr.Login.Username = &p
+	default:
+		found := false
+		for i := range cr.Fields {
+			fn, derr := decStr(ck, ck, cr.Fields[i].Name)
+			if derr == nil && fn == key {
+				fv, err := encStr(c.UserSymKey, value)
+				if err != nil {
+					return err
+				}
+				cr.Fields[i].Value = &fv
+				found = true
+				break
+			}
+		}
+		if !found {
+			fn, _ := encStr(c.UserSymKey, key)
+			fv, _ := encStr(c.UserSymKey, value)
+			cr.Fields = append(cr.Fields, CipherField{Type: 1, Name: &fn, Value: &fv})
+		}
+	}
+	payload := map[string]any{"type": cr.Type, "name": cr.Name}
+	if cr.Login != nil {
+		payload["login"] = cr.Login
+	}
+	if cr.Fields != nil {
+		payload["fields"] = cr.Fields
+	}
+	if cr.Notes != nil {
+		payload["notes"] = *cr.Notes
+	}
+	if _, err := c.EditCipher(cr.ID, payload); err != nil {
+		return err
+	}
+	fmt.Println("updated:", name, key)
+	return nil
+}

cli/cmd/smcli/model.go

@@ -0,0 +1,278 @@
+package main
+
+// Cipher model: decrypt/encrypt for the operations the lane uses
+// (secure notes with hidden fields; login items for password fields).
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// encStr handles empty/unset gracefully.
+type encFunc func(string) (string, error)
+
+type CipherField struct {
+	Type  int     `json:"type"` // 0=text, 1=hidden, 2=boolean (Bitwarden field type)
+	Name  *string `json:"name,omitempty"`
+	Value *string `json:"value,omitempty"`
+}
+
+type CipherLogin struct {
+	Username *string `json:"username,omitempty"`
+	Password *string `json:"password,omitempty"`
+	URIs     []any   `json:"uris,omitempty"`
+}
+
+type cipherRaw struct {
+	ID             string                 `json:"id"`
+	OrganizationID *string                `json:"organizationId"`
+	Type           int                    `json:"type"` // 1=login, 2=secureNote
+	Name           string                 `json:"name"`
+	Notes          *string                `json:"notes"`
+	Fields         []CipherField          `json:"fields,omitempty"`
+	Key            *string                `json:"key,omitempty"`
+	Login          *CipherLogin           `json:"login,omitempty"`
+	SecureNote     map[string]any         `json:"secureNote,omitempty"`
+	DeletedDate    *string                `json:"deletedDate,omitempty"`
+	Extra          map[string]interface{} `json:"-"`
+}
+
+// cipherKeyFor returns the 64B key to use for a cipher's data.
+func cipherKeyFor(userKey []byte, encKey *string) ([]byte, error) {
+	if encKey == nil || *encKey == "" {
+		return userKey, nil
+	}
+	es, err := ParseEncString(*encKey)
+	if err != nil {
+		return nil, err
+	}
+	return symDecrypt(userKey, es)
+}
+
+func decStr(userKey []byte, cipherKey []byte, s *string) (string, error) {
+	if s == nil || *s == "" {
+		return "", nil
+	}
+	es, err := ParseEncString(*s)
+	if err != nil {
+		return "", err
+	}
+	pt, err := symDecrypt(cipherKey, es)
+	if err != nil {
+		return "", err
+	}
+	return string(pt), nil
+}
+
+func encStr(userKey []byte, s string) (string, error) {
+	if s == "" {
+		return "", nil
+	}
+	return symEncrypt(userKey, []byte(s))
+}
+
+// PlainField is a decrypted custom field.
+type PlainField struct {
+	Type  int    `json:"type"`
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+// PlainCipher is a decrypted item view.
+type PlainCipher struct {
+	ID     string       `json:"id"`
+	Name   string       `json:"name"`
+	Notes  string       `json:"notes"`
+	Type   int          `json:"type"`
+	Fields []PlainField `json:"fields"`
+	Login  struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	} `json:"login"`
+	FolderID string   `json:"folderId"`
+	URIs     []string `json:"uris"`
+}
+
+// DecryptCipher converts a raw sync cipher into PlainCipher.
+func DecryptCipher(userKey []byte, raw []byte) (*PlainCipher, error) {
+	var cr cipherRaw
+	if err := json.Unmarshal(raw, &cr); err != nil {
+		return nil, err
+	}
+	if cr.DeletedDate != nil {
+		return nil, fmt.Errorf("deleted")
+	}
+	ck, err := cipherKeyFor(userKey, cr.Key)
+	if err != nil {
+		return nil, err
+	}
+	pc := &PlainCipher{ID: cr.ID, Type: cr.Type}
+	if pc.Name, err = decStr(userKey, ck, &cr.Name); err != nil {
+		return nil, fmt.Errorf("name: %w", err)
+	}
+	if cr.Notes != nil {
+		if pc.Notes, err = decStr(userKey, ck, cr.Notes); err != nil {
+			return nil, fmt.Errorf("notes: %w", err)
+		}
+	}
+	for _, f := range cr.Fields {
+		pf := PlainField{Type: f.Type}
+		if pf.Name, err = decStr(userKey, ck, f.Name); err != nil {
+			continue
+		}
+		if pf.Value, err = decStr(userKey, ck, f.Value); err != nil {
+			continue
+		}
+		pc.Fields = append(pc.Fields, pf)
+	}
+	if cr.Login != nil {
+		if cr.Login.Username != nil {
+			pc.Login.Username, _ = decStr(userKey, ck, cr.Login.Username)
+		}
+		if cr.Login.Password != nil {
+			pc.Login.Password, _ = decStr(userKey, ck, cr.Login.Password)
+		}
+		for _, u := range cr.Login.URIs {
+			var um map[string]any
+			um, _ = u.(map[string]any)
+			if um != nil {
+				if us, ok := um["uri"].(string); ok {
+					v, err := decStr(userKey, ck, &us)
+					if err == nil {
+						pc.URIs = append(pc.URIs, v)
+					}
+				}
+			}
+		}
+	}
+	return pc, nil
+}
+
+// BuildSecureNoteJSON produces an encrypted create/update payload for a
+// secure-note item with hidden fields (type 1).
+func BuildSecureNoteJSON(userKey []byte, name, folderID, notes string, fields []PlainField, existing *cipherRaw) (map[string]any, error) {
+	nameEnc, err := encStr(userKey, name)
+	if err != nil {
+		return nil, err
+	}
+	notesEnc, err := encStr(userKey, notes)
+	if err != nil {
+		return nil, err
+	}
+	var encFields []map[string]any
+	for _, f := range fields {
+		fn, err := encStr(userKey, f.Name)
+		if err != nil {
+			return nil, err
+		}
+		fv, err := encStr(userKey, f.Value)
+		if err != nil {
+			return nil, err
+		}
+		encFields = append(encFields, map[string]any{
+			"type":  f.Type,
+			"name":  fn,
+			"value": fv,
+		})
+	}
+	payload := map[string]any{
+		"type":       2,
+		"name":       nameEnc,
+		"notes":      notesEnc,
+		"fields":     encFields,
+		"secureNote": map[string]any{"type": 0},
+	}
+	if folderID != "" {
+		payload["folderId"] = folderID
+	}
+	if existing != nil {
+		payload["id"] = existing.ID
+		if existing.OrganizationID != nil {
+			payload["organizationId"] = existing.OrganizationID
+		}
+	}
+	return payload, nil
+}
+
+// parseEnvFields parses KEY=VALUE lines (quoted or bare) into hidden fields.
+func parseEnvFields(text string) []PlainField {
+	var out []PlainField
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		eq := strings.Index(line, "=")
+		if eq <= 0 {
+			continue
+		}
+		k := line[:eq]
+		v := line[eq+1:]
+		v = strings.Trim(v, "'\"")
+		out = append(out, PlainField{Type: 1, Name: k, Value: v})
+	}
+	return out
+}
+
+// BuildLoginJSON produces an encrypted login-item payload: username/password
+// as first-class login fields, URIs, and the remaining keys as custom fields
+// (hidden for secrets, text for URLs/IDs).
+func BuildLoginJSON(userKey []byte, name, folderID, username, password string, uris []string, fields []PlainField, existing *cipherRaw) (map[string]any, error) {
+	nameEnc, err := encStr(userKey, name)
+	if err != nil {
+		return nil, err
+	}
+	login := map[string]any{}
+	if username != "" {
+		u, err := encStr(userKey, username)
+		if err != nil {
+			return nil, err
+		}
+		login["username"] = u
+	}
+	if password != "" {
+		p, err := encStr(userKey, password)
+		if err != nil {
+			return nil, err
+		}
+		login["password"] = p
+	}
+	if len(uris) > 0 {
+		var list []map[string]any
+		for _, u := range uris {
+			ue, err := encStr(userKey, u)
+			if err != nil {
+				return nil, err
+			}
+			list = append(list, map[string]any{"uri": ue})
+		}
+		login["uris"] = list
+	}
+	var encFields []map[string]any
+	for _, f := range fields {
+		fn, err := encStr(userKey, f.Name)
+		if err != nil {
+			return nil, err
+		}
+		fv, err := encStr(userKey, f.Value)
+		if err != nil {
+			return nil, err
+		}
+		encFields = append(encFields, map[string]any{"type": f.Type, "name": fn, "value": fv})
+	}
+	payload := map[string]any{"type": 1, "name": nameEnc, "login": login}
+	if len(encFields) > 0 {
+		payload["fields"] = encFields
+	}
+	if folderID != "" {
+		payload["folderId"] = folderID
+	}
+	if existing != nil {
+		payload["id"] = existing.ID
+		if existing.OrganizationID != nil {
+			payload["organizationId"] = existing.OrganizationID
+		}
+	}
+	return payload, nil
+}

cli/cmd/smcli/totp.go

@@ -0,0 +1,34 @@
+package main
+
+// RFC 6238 TOTP (SHA1, 30s, 6 digits) for Bitwarden 2FA provider 0.
+
+import (
+	"crypto/hmac"
+	"crypto/sha1"
+	"encoding/base32"
+	"encoding/binary"
+	"fmt"
+	"strings"
+	"time"
+)
+
+func totpNow(secretB32 string, at time.Time) (string, error) {
+	secret := strings.ToUpper(strings.ReplaceAll(strings.ReplaceAll(secretB32, " ", ""), "-", ""))
+	pad := len(secret) % 8
+	if pad != 0 {
+		secret += strings.Repeat("=", 8-pad)
+	}
+	key, err := base32.StdEncoding.DecodeString(secret)
+	if err != nil {
+		return "", err
+	}
+	counter := uint64(at.Unix()) / 30
+	var ctr [8]byte
+	binary.BigEndian.PutUint64(ctr[:], counter)
+	h := hmac.New(sha1.New, key)
+	h.Write(ctr[:])
+	sum := h.Sum(nil)
+	off := sum[len(sum)-1] & 0x0f
+	code := (binary.BigEndian.Uint32(sum[off:off+4]) & 0x7fffffff) % 1000000
+	return fmt.Sprintf("%06d", code), nil
+}

cli/cmd/smcli/util.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+)
+
+func toHex(b []byte) string { return hex.EncodeToString(b) }
+
+func fromHex(s string) ([]byte, error) {
+	return hex.DecodeString(s)
+}
+
+func hostnameSafe() string {
+	h, err := os.Hostname()
+	if err != nil {
+		return "unknown"
+	}
+	return h
+}
+
+func sha256Sum(b []byte) []byte {
+	s := sha256.Sum256(b)
+	return s[:]
+}

cli/go.mod

@@ -0,0 +1,7 @@
+module git.knownelement.com/KNEL/KNELSecretsManager/cli
+
+go 1.23
+
+require golang.org/x/crypto v0.31.0
+
+require golang.org/x/sys v0.28.0 // indirect

cli/go.sum

@@ -0,0 +1,4 @@
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

docker/Dockerfile.cli

@@ -0,0 +1,12 @@
+# KNELSecretsManager Go CLI — pure Go (no upstream Rust binary, no Node).
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY cli/go.mod cli/go.sum ./
+COPY cli/cmd/ ./cmd/
+RUN go build -ldflags="-s -w" -o /out/smcli ./cmd/smcli
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates && adduser -D -u 65532 app
+COPY --from=build /out/smcli /usr/local/bin/smcli
+USER 65532:65532
+

docker/bw-native/Dockerfile

@@ -0,0 +1,23 @@
+# Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js)
+#
+# Builds a minimal container image around the pre-compiled native bw CLI
+# binary from the official Bitwarden GitHub releases. The binary is a
+# Rust executable with glibc dependencies. No Node.js runtime is
+# included or required.
+#
+# Build prerequisites:
+#   1. Download the native binary:
+#      https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip
+#   2. Unzip and place the `bw` executable next to this Dockerfile.
+#   3. Build: docker build -t reachableceo-bw-native:2026.7.0 .
+#
+# Or use the installer: scripts/bw-install.sh
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+COPY bw /usr/local/bin/bw
+RUN chmod +x /usr/local/bin/bw
+
+ENTRYPOINT ["bw"]

docker/compose.yaml

@@ -0,0 +1,26 @@
+# KNELSecretsManager Go CLI (ukrrs-secretsmgr-cli) — always-hot container per
+# house convention (Charles 2026-08-31): docker exec per invocation, never
+# docker run per call. Scoped ops only; NEVER bare compose down.
+#
+#   docker compose -f /path/to/this up -d smcli
+#   docker exec -i ukrrs-secretsmgr-cli smcli env creds/cloudron
+#
+# Credentials for the vault account come from a 0600 env file (SM_EMAIL,
+# SM_PASSWORD, SM_TOTP_SECRET, SM_SERVER) — never committed.
+name: knel-secretsmanager
+services:
+  smcli:
+    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:46d80c0a0ef53a9303dd54b3799a64a61cd4e4dc892282bc4d8a220378117ce9
+    container_name: ukrrs-secretsmgr-cli
+    restart: unless-stopped
+    entrypoint: ["sleep", "infinity"]
+    init: true
+    env_file:
+      - path: ./smcli.env
+        required: false
+    environment:
+      SM_STATE_DIR: /data/state
+    volumes:
+      - smcli-state:/data/state
+volumes:
+  smcli-state:

docker/smcli.env

@@ -0,0 +1,3 @@
+SM_SERVER=https://pwvault.turnsys.com
+SM_EMAIL=coo@turnsys.com
+SM_STATE_DIR=/data/state

docs/ADR-002-ContainerBW.md

@@ -0,0 +1,77 @@
+# ADR-002: Container-Based Bitwarden CLI (No Host Node.js)
+
+## Status
+
+Accepted (supersedes ADR-001 for BW CLI purposes)
+
+## Context
+
+ADR-001 selected a hybrid Node.js version-management strategy because the
+Bitwarden CLI (`bw`) is distributed via npm and therefore requires a Node.js
+runtime on every consuming host. For TSYS hosts operating under CMMC L3 /
+ITAR / STIG alignment, any host-side language runtime is an attack surface
+and a compliance finding. The KNEL/TSYS baseline ("Docker for everything")
+also forbids host language toolchains.
+
+Bitwarden additionally publishes the CLI as a pre-compiled single binary.
+Distributing that binary inside a minimal pinned container gives every host
+transparent `bw` access with zero host-side runtimes.
+
+## Decision
+
+**Run the official pre-compiled bw binary inside a pinned Docker container,
+exposed to users as a transparent `bw` wrapper at `~/.local/bin/bw`.**
+
+Components (all in this repo):
+
+| File | Role |
+|---|---|
+| `docker/bw-native/Dockerfile` | `debian:12-slim` + ca-certificates + bw binary, pinned `2026.7.0` |
+| `bin/bw-entrypoint.sh` | In-container auth lifecycle: config server, API-key login, unlock, sync, exec |
+| `bin/bw-cli.sh` | Host wrapper: docker run with volume-persisted session, tsys- container prefix |
+| `bin/bw-install.sh` | One-command installer for the wrapper + image |
+
+Credentials live only in `~/.config/bw/env` (single-quoted values, mode 600)
+per the org-wide "no secrets on disk except BW access info" rule. The
+Vaultwarden API key is used for login (no TOTP interaction needed); the
+master password unlocks the vault; `bw sync` runs after every login so
+multi-client vault state stays coherent.
+
+## Known Caveat
+
+The Bitwarden "native" Linux binary is actually a Node.js SEA (Single
+Executable Application): it embeds a Node.js runtime and can print Node
+errors on crash. Node.js is **absent from every host**, which satisfies the
+host-hygiene goal, but the "zero Node.js anywhere" stretch goal is not met.
+Alternatives (Rust vaultwarden clients such as `rbw`) were considered and
+rejected for now due to Vaultwarden API compatibility gaps. Revisit if a
+mature Rust client emerges; the wrapper isolates users from this swap.
+
+## Consequences
+
+### Positive
+
+- Zero language runtimes on hosts (CMMC/ITAR/STIG-friendly host hygiene)
+- Identical bw behavior across all TSYS hosts; version pinned in one Dockerfile
+- Session persistence via named Docker volume; no state divergence when
+  wrapper is used consistently
+- Vendoring into shell frameworks is one installer invocation
+
+### Negative
+
+- Requires Docker on every consuming host (accepted: it is an org baseline)
+- SEA caveat above (Node embedded inside the container image)
+
+## Verification
+
+Deployed and verified on the TSGCOO orchestration host against
+`https://pwvault.turnsys.com` (account `coo@turnsys.com`): status, list,
+generate, get password/totp/item, create/edit items. Shellcheck clean at
+zero warnings including info-level. In production use since 2026-08-13.
+
+---
+
+**Decision Date:** 2026-08-14
+**Decision Makers:** VP TechOps (proposed), TSGCOO (implemented)
+**Related:** ADR-001 (superseded for BW CLI purposes; MISE guidance remains
+valid for projects that genuinely require host Node.js)

docs/ADR-003-GoCLI.md

@@ -0,0 +1,25 @@
+# ADR-003: Custom Go CLI replaces the upstream Rust bw binary
+
+Date: 2026-09-06. Decided by founder directive (finish the project with our
+custom Go cli, not the upstream rust one; no Rust supply-chain risk).
+
+## Decision
+
+KNELSecretsManager ships a pure-Go CLI (`cli/cmd/smcli`) implementing the
+Bitwarden/Vaultwarden API client: prelogin (PBKDF2/Argon2id), password grant
+with 2FA (TOTP), key derivation + decryption (stretched master key, user
+sym key), sync, item create/edit/delete with hidden fields.
+
+The upstream Rust `bw` binary is RETIRED: bin/ scripts moved to
+archive/rust-bw-era/. The CLI ships in our own container
+(golang build -> alpine runtime, CA certs, non-root), delivered as the
+always-hot compose service `ukrrs-secretsmgr-cli` and the lane shim
+`.tools/sm`.
+
+## Consequences
+
+- No Rust/Node supply chain in the secrets tooling; Go module set is
+  stdlib + golang.org/x/crypto.
+- Vault account bootstrapping (password + TOTP) happens via docker exec
+  from the TSGCOO env file; the container env_file holds non-secret config.
+- Rotation waves (#829) rewire consumers from `bwlane.sh`/`.creds` to `sm`.

docs/architecture.md

@@ -0,0 +1,93 @@
+# KNELSecretsManager — Architecture
+
+Status: production. Ruling chain: ADR-002 (containerized CLI) -> ADR-003
+(pure-Go `smcli`, Rust `bw` retired). Founder directives: #829/#832.
+
+## Components
+
+```mermaid
+flowchart LR
+    V["Vaultwarden vault - pwvault.turnsys.com"]
+    C["smcli container - ukrrs-secretsmgr-cli"]
+    S1["TSGCOO entry - data2 TSGCOO bin sm"]
+    S2["lane crossover - tools sm"]
+    W1["mred-vp - Redmine identity"]
+    W2["ci-green.sh - Gitea admin"]
+    W3["redmine-sweep.sh"]
+    B["KNELBMS on-box secrets.yaml"]
+    K["pfv-k8s secrets - glpi-creds, flux PAT"]
+    R["nightly timers - pve backup, glpi reconcile"]
+    S1 --> C
+    S2 --> C
+    W1 --> C
+    W2 --> C
+    W3 --> C
+    C -->|HTTPS login sync CRUD| V
+    C -.-> B
+    C -.-> K
+    C -.-> R
+```
+
+## Auth + unlock sequence
+
+```mermaid
+sequenceDiagram
+    participant U as Consumer
+    participant S as smcli
+    participant V as Vault
+    U->>S: login with email password TOTP seed
+    S->>V: POST prelogin - get KDF params
+    V-->>S: PBKDF2 iterations or Argon2id
+    S->>S: derive master key and auth hash
+    S->>V: POST identity connect token
+    V-->>S: 400 - two factor required
+    S->>S: compute TOTP code - RFC 6238
+    S->>V: token request plus twoFactorToken
+    V-->>S: access token and encrypted keys
+    S->>V: GET sync
+    V-->>S: profile key - encrypted
+    S->>S: stretch master key - decrypt user key
+    S->>S: write state file 0600
+```
+
+Item payloads are type-2 encStrings (AES-256-CBC + HMAC-SHA256, 32B enc +
+32B mac keys) encrypted/decrypted locally; the vault never sees plaintext.
+
+## Consumer pattern
+
+```bash
+# env-style consumers (export lines; URI/USERNAME/PASSWORD + original keys)
+eval "$(docker exec -i ukrrs-secretsmgr-cli smcli env creds/<name>)"
+# surgical single-field rotation update
+docker exec -i ukrrs-secretsmgr-cli smcli setfield creds/<name> <KEY> <newvalue>
+```
+
+Items are LOGIN type: username + password/API-key as first-class fields,
+service URLs as URIs, remaining keys as named custom fields (hidden where
+secret). Original env key names are preserved as the custom-field names.
+
+## Rotation program (#829)
+
+All pre-migration material is presumed BURNED (plaintext on disk + LLM
+exposure). Waves, each item = rotate at source -> `setfield` in vault ->
+rewire consumers to `sm env` -> validate (guard rule: never write the vault
+from a failed rotation):
+
+1. Tooling tokens (librenms*, wazuh DONE, grafana*, gvm, technitium, phpipam,
+   rancher-sectest, beszel, pihole, PMG pair, PBS tokens)
+2. Agent identities (gitea agent-stack, vptechops gitea/redmine)
+3. Platform (cloudron API token, kuma, discourse)
+4. Deep-wired (flux PAT + gitea runner + HA on-box secrets.yaml + k8s
+   secrets + PVE upsagent tokens)
+
+\* item-specific notes: librenms — token-mint API route absent on this
+install (UI/DB path); grafana — SSO-managed, local admin parked (instance
+password policy blocks CLI reset).
+
+## KNELBMS integration
+
+See [integration-knelbms.md](integration-knelbms.md). Short form: the BMS
+deploy pipeline (KNELBMS repo, packages/deploy_pipeline.yaml) consumes
+`gitea_auth_header` + `kuma_push_url` + `pve_*_api_token` from on-box
+`/config/secrets.yaml`; the vault is the source of record and rotations
+push to the box through the CR-gated provisioning path.

docs/integration-knelbms.md

@@ -0,0 +1,50 @@
+# KNELBMS integration — secrets flow
+
+Repo: https://git.knownelement.com/KNEL/KNELBMS (PhysicalPlant lane;
+Home Assistant BMS on VM 100 @ pfv-tsys1, dev -> release deploy by git).
+
+## What the BMS consumes
+
+| On-box secret (HA `secrets.yaml`) | Vault item + field | Provenance |
+|---|---|---|
+| `gitea_auth_header` | `creds/pfv-bms-deploy` -> GITEA_DEPLOY_WATCH_TOKEN | release-branch sha-watch REST sensor |
+| `deploy_webhook_id` / `pfv_relay_webhook_id` | `creds/pfv-bms-deploy` | fast-path deploy webhook |
+| `kuma_push_url` | dead-man monitor `pfv-bms-ha-heartbeat-2026-09` push token | rotated 2026-09-06 under CR 21 |
+| `pve_tsys{1,3,4,5,6,7}_api_token` | `creds/pve-upsagent` (per-node fields) | `upsagent@pam!ups`, PVEAdmin-on-/vms, privsep=0 |
+| `doorman_*`, `pfvbms_smb_*`, beta HA creds | respective `creds/*` items | as rotated |
+
+## Provisioning + rotation flow
+
+```mermaid
+sequenceDiagram
+    participant R as Rotation run - 829 wave
+    participant V as Vault
+    participant B as pfv-bms secrets.yaml
+    participant H as Home Assistant
+    R->>V: setfield new value
+    R->>B: CR-gated provisioning - ssh port 22222
+    R->>H: ha core restart - Kuma window
+    H-->>R: post-deploy validation
+    R->>V: rotation evidence on ticket 829
+```
+
+Rules that bind this flow (house rules + #811):
+
+- pfv-bms prod changes need a GLPI CR **and** a Kuma maintenance window
+  when a restart is involved; the deploy path itself stays
+  dev -> CI -> release PR (founder merges).
+- HA runtime template contexts cannot read secrets — the on-box
+  `shell_command` entries reference `!secret` names only (see KNELBMS
+  PR #6 / CR 21 for the dead-man fix that taught us this).
+- The dead-man heartbeat (`pfv-bms-ha-heartbeat-2026-09`, Kuma id 291)
+  is the canary for provisioning mistakes: if the on-box secret and the
+  vault disagree, the push fails and the monitor pages.
+
+## Current integration state (2026-09-06)
+
+- On-box `secrets.yaml` provisioned manually under CR 21 (PVE tokens +
+  rotated Kuma push URL); git-side KNELBMS matches for the `!secret`
+  keys it owns (PR #6 on dev, awaiting founder release merge).
+- Automated push-from-vault (rotation waves writing the box directly via
+  the AWX ssh path) is **planned, not built** — wave 4. Until then the
+  table above is the manual runbook, executed under CR.

secrets-manager.sh

@@ -44,14 +44,6 @@ install_bitwarden_cli() {
     
     info "Installing Bitwarden CLI..."
     
-    if command -v snap &>/dev/null; then
-        info "Installing via snap..."
-        if sudo snap install bw; then
-            info "Bitwarden CLI installed successfully via snap"
-            return 0
-        fi
-    fi
-    
     if command -v npm &>/dev/null; then
         info "Installing via npm..."
         if sudo npm install -g @bitwarden/cli; then

tests/qa-diagrams.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# qa-diagrams.sh — every ```mermaid block in docs/ must parse in a real renderer.
+# Usage: tests/qa-diagrams.sh   (needs docker + minlag/mermaid-cli + /usr/bin/chromium)
+set -euo pipefail
+QA=$(mktemp -d)
+awk '/^```mermaid/{n++; f=QA"/d"n".mmd"; next} /^```/{f=""; next} f!=""{print > f}' QA="$QA" docs/*.md
+echo '{"args":["--no-sandbox","--disable-setuid-sandbox","--disable-gpu"]}' > "$QA/pptr.json"
+fail=0
+docker run --rm -v "$QA":/qa --entrypoint sh minlag/mermaid-cli:latest -c '
+for f in /qa/d*.mmd; do
+  PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium mmdc -p /qa/pptr.json -i "$f" -o /tmp/out.svg >/dev/null 2>&1 || { echo "PARSE-FAIL: $f"; exit 1; }
+  echo "PARSE-OK: $f"
+done' || fail=1
+rm -rf "$QA"
+exit $fail