mrcharles
c94c0b1de4
Public surface Authenticate/GetSecret/ListSecrets/ListProjects: OAuth client_credentials against /identity/connect/token (with the encrypted_payload organization-key unwrap), refresh-before-expiry, and bearer reads under /api with in-memory decryption. Errors are fixed reason enums that can never embed material. Everything is tested against an in-process fake Secrets Manager speaking the same protocol and crypto (auth failure, expiry, refresh, missing secrets, malformed payloads, tampered MACs, plaintext mode, and redaction sweeps over every error path); the real vault is never contacted.
mopac-bitwarden-go
A 100% Go CLI for Bitwarden / Bitwarden Secrets Manager, replacing the Node
bw CLI in supply-chain-sensitive (CMMC L3/TS posture) environments. One
static binary, one auditable vendored module tree, no Node runtime.
Status: 2026-08-28 — spec seed; reference study complete, open questions pending Charles, no code yet.
Scope
- Talks to the Bitwarden Secrets Manager REST API directly with stdlib — NO official SDK (its source-available license is AGPL-incompatible).
- Machine-account auth (access-token flow) for headless/agent use; human auth flows where needed.
- Porcelain/plumbing model:
bwg get|set|list|sync ...with JSON out for scripting, plain text for humans. - Memory-only secrets handling: session token held in memory for the process lifetime and zeroed on exit; values never written to logs, disk cache, REPORT files, or crash dumps; refs logged only in redacted form.
- Pairs with ukrrs/mopac-keyproxy (placeholder keys to consumers; this CLI is how material gets INTO the vault) but fully standalone.
Non-goals
- No admin UI; a CLI and nothing else.
- Not a vault server — Vaultwarden/Bitwarden stays the store of record.
- No disk cache of secret values; no long-lived persisted sessions by default (open question 4 below may change that, founder's call).
- Not org-specific: hosts/credentials come from config and environment, never baked in.
Today vs planned
| State | |
|---|---|
| Today | Spec only (this README + LICENSE). Interim in production: the KNELSecretsManager containerized bw wrapper (ADR-002) — plain bw behind docker, plaintext env on disk, full login/unlock/sync per call. |
| Planned | Go CLI per the reference study: bw: key-ref resolution for the MOPAC harness, lookup by item name (password field), per-process unlock, never bw logout, typed not-found/unlock errors, fake-bw test stub. |
Design references
- KNELSecretsManager study — current surface, replacement design sketch, open questions (section 3 lists seven open questions for Charles: substrate, machine account, ref syntax, session lifetime, secret names, scope, subprocess injection)
- MOPAC harness DESIGN.md — Toolchain policy, 100% Go HARD RULE
- MOPAC harness DESIGN.md — Key proxy
- Parent: ukrrs/MOPAC — the harness whose
bw:key refs this unblocks
License
AGPLv3 — see LICENSE.