feat: container-based Bitwarden CLI using native Rust binary (no Node.js)

Replace the Node.js @bitwarden/cli dependency with the pre-compiled native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness. The Node.js dependency tree was a significant attack surface that would fail security audits. Infrastructure: - docker/bw-native/Dockerfile: minimal debian-slim + native bw binary - scripts/bw-cli.sh: host wrapper handling full auth lifecycle (config, API-key login, unlock, sync) inside the container - scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle - scripts/bw-install.sh: one-command installer (download, build, deploy) Root causes fixed: - ~/.config/bw/env values now single-quoted (master password has $ chars that shell expansion corrupted, truncating 32→16 chars) - Added BW_SERVER for self-hosted instance (pwvault.turnsys.com) - Entrypoint bw config server tolerates re-run (|| true) All scripts pass shellcheck with zero warnings including info-level. Verified: bw status (unlocked, coo@turnsys.com), generate, list items. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-09-07 14:51:13 -05:00
parent 2c91545c0f
commit dce7164889
8 changed files with 349 additions and 15 deletions
@@ -5,15 +5,24 @@

 ## Current State

-**Phase:** Orientation complete. Environment partially set up. Agent identity
-provisioning execution is BLOCKED on user-provided prerequisites.
+**Phase:** Bitwarden access operational. Container-based CLI (native Rust, no Node.js) deployed and verified. Agent identity provisioning unblocked on BW access — still needs Cloudron invite links and Gitea push credentials.

 **Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) —
 stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).

 ## What's Built

-### This session (TSGCOO)
+### This session (TSGCOO) — BW Infrastructure
+- [x] **Bitwarden access operational** — container-based CLI using native Rust binary
+      (no Node.js at any layer, CMMC/ITAR/STIG-friendly)
+  - `docker/bw-native/Dockerfile` — minimal debian-slim + bw v2026.7.0
+  - `scripts/bw-cli.sh` — host wrapper (auth lifecycle handled internally)
+  - `scripts/bw-entrypoint.sh` — container entrypoint (config, login, unlock, sync)
+  - `scripts/bw-install.sh` — one-command installer
+  - All scripts pass shellcheck (zero warnings, including info-level)
+  - Verified: `bw status` (unlocked, coo@turnsys.com @ pwvault.turnsys.com)
+- [x] **Fixed `~/.config/bw/env`:** single-quoted all values (master password
+      has `$` chars that shell expansion corrupted), added `BW_SERVER`
 - [x] Full orientation — read all 7 planning docs, the provisioning automation,
      and the TSYSGroupAIOS template framework
 - [x] AGENTS.md created for org-buildout repo (committed)
@@ -53,33 +62,35 @@ These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met.

 | # | Item | Status | Detail |
 |---|---|---|---|
-| 1 | **Docker group membership** | BLOCKED | `docker` binary exists but TSGCOO is not in the docker group. `docker info` → permission denied on socket. Fix: `sudo usermod -aG docker TSGCOO` (requires re-login). |
-| 2 | **Bitwarden CLI** | BLOCKED | `bw` not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first). |
-| 3 | **BW credentials** | BLOCKED | `~/.config/bw/env` does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account. |
+| 1 | **Docker group membership** | RESOLVED | TSGCOO has docker access. All 20+ containers running. |
+| 2 | **Bitwarden CLI** | RESOLVED | Container-based native Rust binary deployed. `bw` on PATH via `~/.local/bin/bw` wrapper. No Node.js. |
+| 3 | **BW credentials** | RESOLVED | `~/.config/bw/env` exists with single-quoted values. Verified: `coo@turnsys.com` unlocked on `pwvault.turnsys.com`. Vault is empty (new account, not yet populated). |
 | 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). |
 | 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. |
 | 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). |

 ## What's Ready to Execute (once blockers resolved)

-The provisioning pipeline is ready. Once items 1-5 are resolved:
+BW access is operational. The remaining blockers are:
+- **Cloudron invite links** (item 4) — needed to run the provisioning pipeline
+- **Gitea push credentials** (item 5) — needed to push repos to Gitea
+
+Once item 4 is resolved:

 ```bash
-# 1. Log into Bitwarden
-. ~/.config/bw/env
-bw login --apikey
-export BW_SESSION=$(bw unlock --raw)
+# BW is already operational via the container wrapper
+bw status   # verify access

-# 2. Fill in the manifest
+# Fill in the manifest
 cd ~/projects/agent-identity-provisioning
 cp agents.yaml.example agents.yaml
 # Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links

-# 3. Set BW creds for the container
+# Set BW creds for the container
 cp .env.example .env
-# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD
+# Fill in from ~/.config/bw/env

-# 4. Build and run (provisions all Q3 agents)
+# Build and run (provisions all Q3 agents)
 docker compose up --build

 # Or provision one agent at a time (recommended for first run)
@@ -0,0 +1,12 @@
+# WORKING.md — Active Session Tracker
+
+Agent work only. User actions (deploy, review, UAT) are NOT tracked here.
+The human decides when the work is "done".
+
+## Current Tasks
+
+(none — all agent work is committed)
+
+<!-- To track work, replace the line above with unchecked task lines
+     (hyphen, space, open-bracket, space, close-bracket, space, text).
+     Restore the "none" line before responding to the user. -->
@@ -0,0 +1 @@
+bw
@@ -0,0 +1,23 @@
+# Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js)
+#
+# Builds a minimal container image around the pre-compiled native bw CLI
+# binary from the official Bitwarden GitHub releases. The binary is a
+# Rust executable with glibc dependencies. No Node.js runtime is
+# included or required.
+#
+# Build prerequisites:
+#   1. Download the native binary:
+#      https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip
+#   2. Unzip and place the `bw` executable next to this Dockerfile.
+#   3. Build: docker build -t reachableceo-bw-native:2026.7.0 .
+#
+# Or use the installer: scripts/bw-install.sh
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+COPY bw /usr/local/bin/bw
+RUN chmod +x /usr/local/bin/bw
+
+ENTRYPOINT ["bw"]
@@ -0,0 +1,43 @@
+# JOURNAL.md — Append-Only Decision & Pattern Log
+
+> This file is append-only. Never delete or reorder existing entries.
+> Add one dated section per significant change: what changed, why, the pattern
+> used, any challenges, and the commit hash.
+
+## 2026-08-13
+
+### Bitwarden CLI rebuilt on native Rust binary (no Node.js)
+- **What:** Replaced the Node.js-based `@bitwarden/cli` npm package with the
+  pre-compiled native Rust binary (`bw-linux-2026.7.0.zip` from GitHub releases).
+  Built a minimal Docker image (debian-slim + ca-certificates, no Node.js).
+  Added a host-side wrapper (`scripts/bw-cli.sh`) that handles the full auth
+  lifecycle (server config, API-key login, vault unlock, sync) inside the
+  container on every invocation.
+- **Why:** Charles mandated zero Node.js in TSYS Group infrastructure for
+  security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI
+  dependency tree is a significant attack surface that would fail audits.
+  The native Rust binary has zero runtime dependencies.
+- **Root causes fixed during this work:**
+  1. `~/.config/bw/env` values were unquoted — the master password contains
+     `$` characters that shell expansion corrupted (32-char password truncated
+     to 16 chars on every `source` call). Fixed by single-quoting all values.
+  2. Missing `BW_SERVER` variable — the container defaulted to
+     `vault.bitwarden.com` (Bitwarden cloud) but the org uses a self-hosted
+     instance at `pwvault.turnsys.com`. Added `BW_SERVER` to the env file.
+  3. Container entrypoint `bw config server` fails on re-run (returns exit 1
+     when already logged in). Fixed with `|| true`.
+- **Pattern:** Host wrapper (`scripts/bw-cli.sh`) installed as `~/.local/bin/bw`
+  invokes Docker container (`reachableceo-bw-native:2026.7.0`) with mounted
+  `scripts/bw-entrypoint.sh` that handles auth lifecycle, then execs the
+  requested `bw` subcommand. All execution inside containers; host stays clean.
+- **Files added:**
+  - `docker/bw-native/Dockerfile` — image build definition
+  - `docker/bw-native/.gitignore` — excludes the 141MB binary from git
+  - `scripts/bw-cli.sh` — host wrapper (installed as `~/.local/bin/bw`)
+  - `scripts/bw-entrypoint.sh` — container entrypoint (auth lifecycle)
+  - `scripts/bw-install.sh` — one-command installer (download, build, install)
+  - `WORKING.md` — task tracker
+  - `docs/JOURNAL.md` — this file
+- **Shellcheck:** All scripts pass with zero warnings (including info-level).
+- **Verified against:** `bw status` (unlocked, coo@turnsys.com),
+  `bw generate`, `bw list items`, `bw list collections`.
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
+#
+# Provides transparent `bw` access on hosts where the CLI is not installed
+# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
+# container (debian-slim + ca-certificates, NO Node.js).
+#
+# All tool execution happens inside the container. Nothing runs on the host
+# except this wrapper, which only invokes docker.
+#
+# Usage:
+#   bw-cli.sh status                 Check vault status
+#   bw-cli.sh list items             List vault items
+#   bw-cli.sh list collections       List collections
+#   bw-cli.sh get password "Item"    Retrieve a password
+#   bw-cli.sh get totp "Item"        Retrieve a TOTP code
+#   bw-cli.sh get item "Item"        Full item JSON
+#   bw-cli.sh generate -ulns         Generate a password
+#
+# Install to ~/.local/bin/bw via:
+#   scripts/bw-install.sh
+#
+# Environment overrides:
+#   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
+#   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
+#   BW_VOLUME     Docker volume for persisted login state
+#                 (default: tsys-bw-cli-state)
+#   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)
+
+set -euo pipefail
+
+BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
+BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
+BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
+BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
+
+# --- Validate prerequisites ---
+if [ ! -f "$BW_ENV_FILE" ]; then
+    echo "bw: credential file not found: $BW_ENV_FILE" >&2
+    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
+    exit 1
+fi
+
+if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
+    echo "bw: Docker image not found: $BW_IMAGE" >&2
+    echo "    build it: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
+    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
+    echo "    install via: scripts/bw-install.sh" >&2
+    exit 1
+fi
+
+# --- Load credentials (values are single-quoted in env file) ---
+set -a
+# shellcheck source=/dev/null
+. "$BW_ENV_FILE"
+set +a
+
+# --- Create persistent volume for BW CLI login state ---
+docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
+
+# --- Run bw inside the container ---
+docker run --rm -i \
+    -e BW_CLIENTID \
+    -e BW_CLIENTSECRET \
+    -e BW_PASSWORD \
+    -e BW_SERVER \
+    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
+    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
+    --entrypoint sh \
+    "$BW_IMAGE" \
+    /opt/bw/entrypoint.sh "$@"
@@ -0,0 +1,44 @@
+#!/bin/sh
+# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
+#
+# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
+# Handles: server config, API-key login, vault unlock, sync.
+# Then execs the real bw command with BW_SESSION set.
+#
+# API key authentication does NOT require TOTP. The API key itself is
+# obtained from an authenticated web vault session, so 2FA is already
+# satisfied at key-generation time.
+#
+# This script intentionally uses /bin/sh (not bash) for minimal container
+# compatibility. shellcheck directive below silences the "not bash" note.
+# shellcheck shell=sh
+
+set -e
+
+BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
+
+# Suppress BW CLI data-dir creation noise and telemetry.
+export BW_NO_SENTRY=true
+
+# --- Step 1: Configure server (fails harmlessly if already logged in) ---
+bw config server "$BW_SERVER" >/dev/null 2>&1 || true
+
+# --- Step 2: Login via API key (silently skips if already authenticated) ---
+bw login --apikey >/dev/null 2>&1 || true
+
+# --- Step 3: Unlock the vault ---
+printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
+SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
+rm -f /tmp/.bwpw
+if [ -z "$SESS" ]; then
+    echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
+    echo "    Values must be single-quoted; \$ chars get mangled if unquoted." >&2
+    exit 1
+fi
+
+# --- Step 4: Sync ---
+bw sync --session "$SESS" >/dev/null 2>&1 || true
+
+# --- Step 5: Execute the requested command ---
+export BW_SESSION="$SESS"
+exec bw "$@"
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# bw-install.sh — Install the container-based Bitwarden CLI wrapper.
+#
+# Downloads the native Rust bw binary, builds the Docker image, and installs
+# the host-side wrapper plus container entrypoint to the user's local paths.
+# No Node.js is involved at any layer.
+#
+# Usage:
+#   bw-install.sh                Download, build, and install everything
+#   bw-install.sh --check        Verify installation status without changes
+#
+# Prerequisites:
+#   - docker on PATH
+#   - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS)
+#
+# After install, ~/.local/bin/bw provides transparent CLI access. Add
+# ~/.local/bin to PATH if not already (most distros do this via ~/.profile).
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$HERE/.." && pwd)"
+
+BW_VERSION="2026.7.0"
+BW_IMAGE="reachableceo-bw-native:${BW_VERSION}"
+BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip"
+
+INSTALL_BIN="${HOME}/.local/bin"
+INSTALL_LIB="${HOME}/.local/share/bw"
+BUILD_DIR=""
+
+# --- Helpers ---
+log_info()  { printf '\033[0;34m›\033[0m %s\n' "$*"; }
+log_ok()    { printf '\033[0;32m✓\033[0m %s\n' "$*"; }
+log_warn()  { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; }
+log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; }
+log_step()  { printf '\n\033[1m== %s ==\033[0m\n' "$*"; }
+die()       { log_error "$*"; exit 1; }
+
+# --- Cleanup on exit ---
+cleanup() {
+    [ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR"
+}
+trap cleanup EXIT
+
+# --- Check mode ---
+if [ "${1:-}" = "--check" ]; then
+    log_step "BW CLI installation check"
+    if command -v docker >/dev/null 2>&1; then
+        log_ok "docker on PATH"
+    else
+        log_error "docker not on PATH"
+    fi
+    if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
+        log_ok "Docker image ${BW_IMAGE} exists"
+    else
+        log_error "Docker image ${BW_IMAGE} missing"
+    fi
+    if [ -x "${INSTALL_BIN}/bw" ]; then
+        log_ok "Host wrapper at ${INSTALL_BIN}/bw"
+    else
+        log_error "Host wrapper at ${INSTALL_BIN}/bw missing"
+    fi
+    if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then
+        log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh"
+    else
+        log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing"
+    fi
+    exit 0
+fi
+
+# --- Prerequisites ---
+command -v docker >/dev/null 2>&1 || die "docker not found on PATH"
+
+log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)"
+
+# --- Step 1: Download and extract the native binary ---
+BUILD_DIR=$(mktemp -d)
+log_info "Downloading bw ${BW_VERSION} native binary..."
+
+docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \
+    sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \
+           wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \
+           unzip -o /build/bw.zip -d /build/ && \
+           rm /build/bw.zip && \
+           chmod +x /build/bw"
+
+[ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found"
+log_ok "Downloaded native binary"
+
+# --- Step 2: Build the Docker image ---
+log_info "Building Docker image ${BW_IMAGE}..."
+
+DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native"
+if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then
+    die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile"
+fi
+
+cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw"
+docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR"
+rm -f "${DOCKERFILE_DIR}/bw"
+log_ok "Built image ${BW_IMAGE}"
+
+# --- Step 3: Install host-side wrapper and entrypoint ---
+mkdir -p "$INSTALL_BIN" "$INSTALL_LIB"
+
+cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw"
+chmod 755 "${INSTALL_BIN}/bw"
+log_ok "Installed wrapper to ${INSTALL_BIN}/bw"
+
+cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh"
+chmod 755 "${INSTALL_LIB}/entrypoint.sh"
+log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh"
+
+# --- Step 4: Verify ---
+log_info "Verifying installation..."
+if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then
+    log_ok "bw CLI is operational"
+else
+    log_warn "bw wrapper installed but verification call failed"
+    log_warn "check ~/.config/bw/env credentials and try: bw status"
+fi
+
+log_step "Installation complete"
+log_info "Usage: bw status | bw list items | bw get password \"Item Name\""