Goal
Add a cross-platform online vault target that can be authenticated and scheduled after reboot without relying on lastpass-cli.
Why Bitwarden
The official bw CLI runs on macOS, Linux, and Windows, creates/edits vault items, pushes changes automatically, supports API-key login, and documents noninteractive unlock through a master-password environment variable. This is a supported public surface, unlike LastPass's absent vault-write API.
Proposed auth shape
Explicit opt-in stores three values in Hush: BW_CLIENTID, BW_CLIENTSECRET, and the Bitwarden master password. A Node runner starts under hush run, calls bw login --apikey, unlocks with --passwordenv, captures the session key only in memory, passes it to child bw commands through BW_SESSION, and clears it on exit. No session key in argv, logs, config, or disk.
Sync shape
- hush sync bitwarden [--folder hush] [--exclude name] [name ...]
- validate every selected local name before the first remote write
- create missing items and update unique items
- fail closed on duplicates, locked vault, MFA/auth, or remote rejection
- deterministic fake-bw coverage first
- real disposable-account test before release
References
Official CLI docs: https://bitwarden.com/help/cli/
Official vault sync behavior: https://bitwarden.com/help/vault-sync/
Goal
Add a cross-platform online vault target that can be authenticated and scheduled after reboot without relying on lastpass-cli.
Why Bitwarden
The official bw CLI runs on macOS, Linux, and Windows, creates/edits vault items, pushes changes automatically, supports API-key login, and documents noninteractive unlock through a master-password environment variable. This is a supported public surface, unlike LastPass's absent vault-write API.
Proposed auth shape
Explicit opt-in stores three values in Hush: BW_CLIENTID, BW_CLIENTSECRET, and the Bitwarden master password. A Node runner starts under hush run, calls bw login --apikey, unlocks with --passwordenv, captures the session key only in memory, passes it to child bw commands through BW_SESSION, and clears it on exit. No session key in argv, logs, config, or disk.
Sync shape
References
Official CLI docs: https://bitwarden.com/help/cli/
Official vault sync behavior: https://bitwarden.com/help/vault-sync/