# JOURNAL.md — Append-Only Decision & Pattern Log

> This file is append-only. Never delete or reorder existing entries.
> Add one dated section per significant change: what changed, why, the pattern
> used, any challenges, and the commit hash.

## 2026-08-13

### Bitwarden CLI rebuilt on native Rust binary (no Node.js)
- **What:** Replaced the Node.js-based `@bitwarden/cli` npm package with the
  pre-compiled native Rust binary (`bw-linux-2026.7.0.zip` from GitHub releases).
  Built a minimal Docker image (debian-slim + ca-certificates, no Node.js).
  Added a host-side wrapper (`scripts/bw-cli.sh`) that handles the full auth
  lifecycle (server config, API-key login, vault unlock, sync) inside the
  container on every invocation.
- **Why:** Charles mandated zero Node.js in TSYS Group infrastructure for
  security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI
  dependency tree is a significant attack surface that would fail audits.
  The native Rust binary has zero runtime dependencies.
- **Root causes fixed during this work:**
  1. `~/.config/bw/env` values were unquoted — the master password contains
     `$` characters that shell expansion corrupted (32-char password truncated
     to 16 chars on every `source` call). Fixed by single-quoting all values.
  2. Missing `BW_SERVER` variable — the container defaulted to
     `vault.bitwarden.com` (Bitwarden cloud) but the org uses a self-hosted
     instance at `pwvault.turnsys.com`. Added `BW_SERVER` to the env file.
  3. Container entrypoint `bw config server` fails on re-run (returns exit 1
     when already logged in). Fixed with `|| true`.
- **Pattern:** Host wrapper (`scripts/bw-cli.sh`) installed as `~/.local/bin/bw`
  invokes Docker container (`reachableceo-bw-native:2026.7.0`) with mounted
  `scripts/bw-entrypoint.sh` that handles auth lifecycle, then execs the
  requested `bw` subcommand. All execution inside containers; host stays clean.
- **Files added:**
  - `docker/bw-native/Dockerfile` — image build definition
  - `docker/bw-native/.gitignore` — excludes the 141MB binary from git
  - `scripts/bw-cli.sh` — host wrapper (installed as `~/.local/bin/bw`)
  - `scripts/bw-entrypoint.sh` — container entrypoint (auth lifecycle)
  - `scripts/bw-install.sh` — one-command installer (download, build, install)
  - `WORKING.md` — task tracker
  - `docs/JOURNAL.md` — this file
- **Shellcheck:** All scripts pass with zero warnings (including info-level).
- **Verified against:** `bw status` (unlocked, coo@turnsys.com),
  `bw generate`, `bw list items`, `bw list collections`.