@arloraccoon/openclaw-vaultwarden-plugin 0.1.0

package/dist/index.mjs

@@ -0,0 +1,752 @@
+// index.ts
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+
+// src/auth-cli.ts
+import { chmodSync, closeSync, mkdirSync, openSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+var defaultSessionFile = "~/.openclaw/secrets/vaultwarden-session";
+function expandHome(path) {
+  return path.startsWith("~/") ? resolve(process.env.HOME ?? ".", path.slice(2)) : resolve(path);
+}
+function storeSessionToken(token, file) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    throw new Error("Bitwarden CLI returned an empty session");
+  }
+  const target = expandHome(file);
+  mkdirSync(dirname(target), { recursive: true, mode: 448 });
+  const temp = `${target}.${process.pid}.tmp`;
+  const fd = openSync(temp, "wx", 384);
+  try {
+    chmodSync(temp, 384);
+    writeFileSync(fd, `${trimmed}
+`, { encoding: "utf8" });
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(temp, target);
+  return target;
+}
+function unlockWithBitwardenCli() {
+  const result = spawnSync("bw", ["unlock", "--raw"], {
+    stdio: ["inherit", "pipe", "inherit"],
+    encoding: "utf8",
+    maxBuffer: 64 * 1024
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error("Bitwarden CLI unlock failed");
+  }
+  return result.stdout ?? "";
+}
+function loginWithBitwardenCli() {
+  const result = spawnSync("bw", ["login"], { stdio: "inherit" });
+  if (result.error || result.status !== 0) {
+    throw new Error("Bitwarden CLI login failed");
+  }
+}
+function isBitwardenLoggedIn() {
+  const result = spawnSync("bw", ["status", "--raw"], {
+    stdio: ["ignore", "pipe", "ignore"],
+    encoding: "utf8",
+    maxBuffer: 64 * 1024
+  });
+  if (result.error || result.status !== 0) {
+    return false;
+  }
+  try {
+    const status = JSON.parse(result.stdout ?? "");
+    return status.status !== "unauthenticated";
+  } catch {
+    return false;
+  }
+}
+function registerVaultwardenAuthCli(program, options = {}) {
+  program.command("vaultwarden").description("Configure a local Vaultwarden CLI session for OpenClaw").option("--session-file <path>", "0600 file for the session token", defaultSessionFile).action(async ({ sessionFile = defaultSessionFile }) => {
+    try {
+      if (!isBitwardenLoggedIn()) {
+        (options.login ?? loginWithBitwardenCli)();
+      }
+      const target = storeSessionToken(
+        (options.unlock ?? unlockWithBitwardenCli)(),
+        sessionFile
+      );
+      console.log(`Vaultwarden session stored at ${target}`);
+      console.log(
+        `Configure a file SecretRef: provider source=file, path=${target}, mode=singleValue, id=value`
+      );
+      console.log(
+        'Then set plugins.entries.vaultwarden.config.session to {"source":"file","provider":"vaultwarden_session","id":"value"}.'
+      );
+    } catch {
+      console.error("Vaultwarden session setup failed");
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/cli.ts
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { resolveConfiguredSecretInputString } from "openclaw/plugin-sdk/secret-input-runtime";
+var execFileAsync = promisify(execFile);
+function execWithInput(file, args, options) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(file, args, {
+      env: options.env,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    let failed = false;
+    let timedOut = false;
+    let overflow = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+    }, options.timeout);
+    const forceKill = setTimeout(() => child.kill("SIGKILL"), options.timeout + 1e3);
+    forceKill.unref();
+    const fail = (error) => {
+      if (failed) return;
+      failed = true;
+      clearTimeout(timeout);
+      clearTimeout(forceKill);
+      reject(error);
+    };
+    child.once("error", (error) => fail(error));
+    child.stdout.on("data", (chunk) => {
+      outputBytes += chunk.length;
+      if (outputBytes > options.maxBuffer) {
+        overflow = true;
+        child.kill("SIGTERM");
+        return;
+      }
+      stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      outputBytes += chunk.length;
+      if (outputBytes > options.maxBuffer) {
+        overflow = true;
+        child.kill("SIGTERM");
+        return;
+      }
+      stderr.push(chunk);
+    });
+    child.once("close", (code, signal) => {
+      clearTimeout(timeout);
+      clearTimeout(forceKill);
+      if (failed) return;
+      const result = {
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8")
+      };
+      if (overflow) {
+        fail(Object.assign(new Error("Vaultwarden CLI output exceeded its limit"), result));
+      } else if (timedOut) {
+        fail(Object.assign(new Error("Vaultwarden CLI command timed out"), result));
+      } else if (code !== 0) {
+        fail(Object.assign(new Error(`Vaultwarden CLI exited with ${signal ?? code ?? "unknown status"}`), result));
+      } else {
+        resolve2(result);
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(options.input ?? "", "utf8");
+  });
+}
+function parseBwStatus(stdout) {
+  const parsed = JSON.parse(stdout);
+  return {
+    serverUrl: typeof parsed.serverUrl === "string" ? parsed.serverUrl : void 0,
+    status: typeof parsed.status === "string" ? parsed.status : void 0
+  };
+}
+function cliErrorText(error) {
+  if (typeof error === "string") {
+    return error;
+  }
+  if (!error || typeof error !== "object") {
+    return "";
+  }
+  const details = error;
+  return [details.message, details.stderr].filter((value) => typeof value === "string").join("\n");
+}
+function sessionRecoverySource(session, sessionEnv, inherited) {
+  if (typeof session === "string") return "inline";
+  if (session && typeof session === "object" && "source" in session) {
+    const source = session.source;
+    if (source === "file" || source === "env" || source === "exec" || source === "store") {
+      return source;
+    }
+  }
+  return inherited[sessionEnv] ? "env" : "default";
+}
+function recoveryInstruction(source) {
+  switch (source) {
+    case "file":
+      return "Refresh the file configured for the Vaultwarden SecretRef, then retry. For a single-value file provider, run `openclaw vaultwarden --session-file <configured-path>` in a trusted terminal; do not use that command on a JSON provider file.";
+    case "env":
+      return "Refresh the configured environment SecretRef in the Gateway's environment, then retry. `openclaw vaultwarden` writes a local file and does not replace an environment SecretRef.";
+    case "exec":
+    case "store":
+      return "Refresh the configured SecretRef at its provider, then retry. `openclaw vaultwarden` writes a local file and does not update that provider.";
+    case "inline":
+      return "Replace the configured session value with a freshly unlocked session using a secure local configuration path; do not paste it into chat. `openclaw vaultwarden` writes a local file but does not change inline configuration.";
+    default:
+      return "On the OpenClaw host, run `openclaw vaultwarden` in a trusted terminal to create the default local session file, then configure the plugin session as a file SecretRef to that file and retry. The CLI does not read the file automatically.";
+  }
+}
+var sessionFailurePattern = /(?:session|token|authentication|credential).{0,48}(?:expired|invalid|unauthori[sz]ed|rejected|not valid)|(?:expired|invalid|unauthori[sz]ed|rejected).{0,48}(?:session|token|credential)|not logged in|you are not logged in|vault is locked|vault must be unlocked|\b401\b/i;
+function redactCliError(error) {
+  if (sessionFailurePattern.test(cliErrorText(error))) {
+    const source = error && typeof error === "object" && "recoverySource" in error ? error.recoverySource : void 0;
+    return `Vaultwarden session is unavailable or expired. ${recoveryInstruction(source ?? "default")} The plugin will not prompt for or expose the master password.`;
+  }
+  return "Vaultwarden CLI command failed";
+}
+function createBitwardenCliRunner(params) {
+  const sessionEnv = params?.sessionEnv ?? "BW_SESSION";
+  const timeout = (params?.timeoutSeconds ?? 15) * 1e3;
+  const inherited = params?.env ?? process.env;
+  const executor = params?.executor ?? execFileAsync;
+  const env = {
+    PATH: inherited.PATH
+  };
+  for (const key of [
+    "HOME",
+    "USERPROFILE",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    sessionEnv,
+    "BITWARDENCLI_APPDATA_DIR",
+    "NODE_EXTRA_CA_CERTS"
+  ]) {
+    if (inherited[key]) {
+      env[key] = inherited[key];
+    }
+  }
+  return async (args, stdin) => {
+    const commandEnv = { ...env };
+    const config = typeof params?.config === "function" ? params.config() : params?.config;
+    const session = typeof params?.session === "function" ? params.session() : params?.session;
+    if (session !== void 0 && config) {
+      const resolved = await resolveConfiguredSecretInputString({
+        config,
+        env: inherited,
+        value: session,
+        path: "plugins.entries.vaultwarden.config.session"
+      });
+      if (resolved.value) {
+        commandEnv[sessionEnv] = resolved.value;
+      }
+      params?.onSessionResolution?.({
+        configured: true,
+        resolved: Boolean(resolved.value),
+        reason: resolved.unresolvedRefReason
+      });
+    } else {
+      params?.onSessionResolution?.({ configured: session !== void 0, resolved: false });
+    }
+    let result;
+    try {
+      const executionOptions = {
+        env: commandEnv,
+        timeout,
+        maxBuffer: 2 * 1024 * 1024,
+        ...stdin === void 0 ? {} : { input: stdin }
+      };
+      if (stdin === void 0) {
+        result = await executor("bw", args, executionOptions);
+      } else if (executor === execFileAsync) {
+        result = await execWithInput("bw", args, executionOptions);
+      } else {
+        result = await executor("bw", args, executionOptions);
+      }
+    } catch (error) {
+      const details = error && typeof error === "object" ? error : {};
+      const contextual = new Error(
+        typeof details.message === "string" ? details.message : "Vaultwarden CLI command failed"
+      );
+      if (typeof details.stderr === "string") contextual.stderr = details.stderr;
+      contextual.recoverySource = sessionRecoverySource(session, sessionEnv, inherited);
+      throw contextual;
+    }
+    return { stdout: result.stdout, stderr: result.stderr };
+  };
+}
+
+// src/status-tool.ts
+import { Type } from "typebox";
+import { textResult } from "openclaw/plugin-sdk/tool-results";
+
+// src/audit.ts
+function emitVaultwardenAudit(audit, operation, outcome) {
+  if (!audit) {
+    return;
+  }
+  try {
+    audit({ event: "vaultwarden.tool", operation, outcome });
+  } catch {
+  }
+}
+
+// src/status-tool.ts
+function createVaultwardenStatusTool(runner, audit) {
+  return {
+    name: "vaultwarden_status",
+    label: "Vaultwarden Status",
+    description: "Check Vaultwarden connectivity, authentication, and lock state without returning vault contents or credentials.",
+    parameters: Type.Object({}, { additionalProperties: false }),
+    execute: async () => {
+      try {
+        const result = await runner(["status"]);
+        const status = parseBwStatus(result.stdout);
+        emitVaultwardenAudit(audit, "status", "success");
+        return textResult(JSON.stringify(status), status);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "status", "error");
+        return Object.assign(textResult(redactCliError(error), { error: true }), { isError: true });
+      }
+    }
+  };
+}
+
+// src/vault-tools.ts
+import { Type as Type2 } from "typebox";
+import { textResult as textResult2 } from "openclaw/plugin-sdk/tool-results";
+
+// src/vault.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var MAX_ITEM_BYTES = 64 * 1024;
+var MAX_SECRET_BYTES = 24 * 1024;
+function checkedString(value, label, maxBytes = MAX_SECRET_BYTES) {
+  if (typeof value !== "string" || !value.trim() || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value) || Buffer.byteLength(value, "utf8") > maxBytes) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return value;
+}
+function checkedNote(value) {
+  if (typeof value !== "string" || !value.trim() || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value) || Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES) {
+    throw new Error("Invalid notes");
+  }
+  return value;
+}
+function checkedId(value, label) {
+  if (typeof value !== "string" || !UUID.test(value)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return value;
+}
+function checkedUriList(uris) {
+  if (!Array.isArray(uris) || uris.length > 100) throw new Error("Invalid URIs");
+  return uris.map((uri) => ({ uri: checkedString(uri, "URI", 4096) }));
+}
+function checkedFields(fields) {
+  if (!Array.isArray(fields) || fields.length > 100) throw new Error("Invalid fields");
+  const names = /* @__PURE__ */ new Set();
+  return fields.map((value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid field");
+    const field = value;
+    const name = checkedString(field.name, "field name", 256);
+    if (names.has(name)) throw new Error("Duplicate field name");
+    names.add(name);
+    if (field.type !== void 0 && field.type !== "text" && field.type !== "hidden") {
+      throw new Error("Invalid field type");
+    }
+    return {
+      name,
+      value: checkedString(field.value, "field value"),
+      type: field.type === "text" ? 0 : 1
+    };
+  });
+}
+function checkedCollectionIds(value) {
+  if (!Array.isArray(value) || value.length > 100) throw new Error("Invalid collections");
+  return value.map((id) => checkedId(id, "collection ID"));
+}
+function buildLoginVaultItem(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("Invalid item");
+  const item = {
+    type: 1,
+    name: checkedString(input.name, "item name", 256)
+  };
+  const login = {};
+  if (input.username !== void 0) login.username = checkedString(input.username, "username");
+  if (input.password !== void 0) login.password = checkedString(input.password, "password");
+  if (input.uris !== void 0) login.uris = checkedUriList(input.uris);
+  if (Object.keys(login).length > 0) item.login = login;
+  if (input.notes !== void 0) item.notes = checkedNote(input.notes);
+  if (input.folderId !== void 0) {
+    item.folderId = input.folderId === null ? null : checkedId(input.folderId, "folder ID");
+  }
+  if (input.collectionIds !== void 0) item.collectionIds = checkedCollectionIds(input.collectionIds);
+  if (input.fields !== void 0) item.fields = checkedFields(input.fields);
+  if (input.favorite !== void 0) {
+    if (typeof input.favorite !== "boolean") throw new Error("Invalid favorite flag");
+    item.favorite = input.favorite;
+  }
+  return item;
+}
+function mergeLoginVaultItem(raw, patch) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Invalid existing item");
+  const existing = raw;
+  const itemId = checkedId(existing.id, "item ID");
+  if (existing.type !== 1 || !existing.login || typeof existing.login !== "object") {
+    throw new Error("Only login items can be updated");
+  }
+  if (!patch || typeof patch !== "object" || Array.isArray(patch)) throw new Error("Invalid update");
+  const item = structuredClone(existing);
+  item.id = itemId;
+  if (patch.name !== void 0) item.name = checkedString(patch.name, "item name", 256);
+  if (patch.folderId !== void 0) {
+    item.folderId = patch.folderId === null ? null : checkedId(patch.folderId, "folder ID");
+  }
+  if (patch.collectionIds !== void 0) item.collectionIds = checkedCollectionIds(patch.collectionIds);
+  if (patch.fields !== void 0) item.fields = checkedFields(patch.fields);
+  if (patch.favorite !== void 0) {
+    if (typeof patch.favorite !== "boolean") throw new Error("Invalid favorite flag");
+    item.favorite = patch.favorite;
+  }
+  if (patch.notes !== void 0) item.notes = patch.notes === null ? null : checkedNote(patch.notes);
+  const login = { ...item.login ?? {} };
+  if (patch.username !== void 0) {
+    login.username = patch.username === null ? null : checkedString(patch.username, "username");
+  }
+  if (patch.password !== void 0) {
+    login.password = patch.password === null ? null : checkedString(patch.password, "password");
+  }
+  if (patch.uris !== void 0) login.uris = checkedUriList(patch.uris);
+  item.login = login;
+  const changed = Object.keys(patch).some((key) => key !== "itemId");
+  if (!changed) throw new Error("No item fields were supplied");
+  if (Buffer.byteLength(JSON.stringify(item), "utf8") > MAX_ITEM_BYTES) throw new Error("Item is too large");
+  return item;
+}
+function encodeVaultItem(item) {
+  const serialized = JSON.stringify(item);
+  if (Buffer.byteLength(serialized, "utf8") > MAX_ITEM_BYTES) throw new Error("Item is too large");
+  return Buffer.from(serialized, "utf8").toString("base64");
+}
+function parseMutationItem(stdout) {
+  const raw = JSON.parse(stdout);
+  const safe = redactVaultItem(raw);
+  if (!UUID.test(safe.id) || safe.name === "Unnamed item") throw new Error("Invalid item response");
+  return safe;
+}
+async function createLoginVaultItem(params) {
+  const item = buildLoginVaultItem(params.item);
+  const result = await params.runner(["create", "item"], encodeVaultItem(item));
+  return parseMutationItem(result.stdout);
+}
+async function updateLoginVaultItem(params) {
+  const itemId = checkedId(params.itemId, "item ID");
+  const current = await params.runner(["get", "item", itemId]);
+  const item = mergeLoginVaultItem(JSON.parse(current.stdout), params.patch);
+  const result = await params.runner(["edit", "item", itemId], encodeVaultItem(item));
+  return parseMutationItem(result.stdout);
+}
+async function deleteLoginVaultItem(params) {
+  const itemId = checkedId(params.itemId, "item ID");
+  await params.runner(["delete", "item", itemId]);
+  return { id: itemId, deleted: true };
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function redactVaultItem(raw) {
+  const item = {
+    id: stringValue(raw.id) ?? "unknown",
+    name: stringValue(raw.name) ?? "Unnamed item"
+  };
+  if (typeof raw.type === "number") {
+    item.type = raw.type;
+  }
+  if (raw.folderId === null || typeof raw.folderId === "string") {
+    item.folderId = raw.folderId;
+  }
+  if (Array.isArray(raw.collectionIds)) {
+    item.collectionIds = raw.collectionIds.filter(
+      (value) => typeof value === "string"
+    );
+  }
+  if (raw.login && Array.isArray(raw.login.uris)) {
+    const uris = raw.login.uris.map((entry) => stringValue(entry.uri)).filter((value) => Boolean(value));
+    if (uris.length > 0) {
+      item.login = { uris };
+    }
+  }
+  return item;
+}
+function parseItemList(stdout, maxResults) {
+  const parsed = JSON.parse(stdout);
+  if (!Array.isArray(parsed)) {
+    throw new Error("Vaultwarden returned an invalid item list");
+  }
+  return parsed.slice(0, maxResults).map((item) => redactVaultItem(item));
+}
+async function searchVaultItems(params) {
+  const result = await params.runner(["list", "items", "--search", params.query]);
+  return parseItemList(result.stdout, params.maxResults);
+}
+async function getVaultItem(params) {
+  const result = await params.runner(["get", "item", params.itemId]);
+  return redactVaultItem(JSON.parse(result.stdout));
+}
+function parseVaultObjects(stdout, maxResults) {
+  const parsed = JSON.parse(stdout);
+  if (!Array.isArray(parsed)) {
+    throw new Error("Vaultwarden returned an invalid object list");
+  }
+  return parsed.slice(0, maxResults).map((value) => {
+    const raw = value;
+    const object = {
+      id: stringValue(raw.id) ?? "unknown",
+      name: stringValue(raw.name) ?? "Unnamed object"
+    };
+    const organizationId = stringValue(raw.organizationId);
+    if (organizationId) {
+      object.organizationId = organizationId;
+    }
+    return object;
+  });
+}
+async function listVaultObjects(params) {
+  const result = await params.runner(["list", params.object]);
+  return parseVaultObjects(result.stdout, params.maxResults);
+}
+
+// src/vault-tools.ts
+function jsonToolResult(value) {
+  return textResult2(JSON.stringify(value), value);
+}
+function errorToolResult(error) {
+  return Object.assign(textResult2(redactCliError(error), { error: true }), { isError: true });
+}
+var UUID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+var uuidSchema = Type2.String({ pattern: UUID_PATTERN });
+var itemIdSchema = Type2.String({ pattern: UUID_PATTERN, description: "Exact Vaultwarden item UUID." });
+var optionalText = (description) => Type2.Optional(Type2.String({ maxLength: 24576, description }));
+var optionalNullableText = (description) => Type2.Optional(Type2.Union([Type2.String({ maxLength: 24576, description }), Type2.Null()]));
+var uriArray = Type2.Array(Type2.String({ minLength: 1, maxLength: 4096 }), { maxItems: 100 });
+var fieldArray = Type2.Array(
+  Type2.Object(
+    {
+      name: Type2.String({ minLength: 1, maxLength: 256 }),
+      value: Type2.String({ minLength: 1, maxLength: 24576, description: "Stored in the vault; never returned by this tool." }),
+      type: Type2.Optional(Type2.Union([Type2.Literal("hidden"), Type2.Literal("text")]))
+    },
+    { additionalProperties: false }
+  ),
+  { maxItems: 100 }
+);
+var loginItemFields = {
+  name: Type2.String({ minLength: 1, maxLength: 256, description: "Vault item name." }),
+  username: optionalText("Stored in the vault; not returned by plugin read tools."),
+  password: optionalText("Stored in the vault; never returned by this tool."),
+  uris: Type2.Optional(uriArray),
+  notes: optionalText("Stored in the vault; never returned by this tool."),
+  folderId: Type2.Optional(Type2.Union([Type2.String({ pattern: UUID_PATTERN }), Type2.Null()])),
+  collectionIds: Type2.Optional(Type2.Array(uuidSchema, { maxItems: 100 })),
+  fields: Type2.Optional(fieldArray),
+  favorite: Type2.Optional(Type2.Boolean())
+};
+function createVaultwardenCreateItemTool(runner, audit) {
+  return {
+    name: "vaultwarden_create_item",
+    label: "Vaultwarden Create Login Item",
+    description: "Create one login item when mutations are enabled. Secret fields are sent to the local Bitwarden CLI over stdin and are never returned or audited. Use only when explicitly requested.",
+    parameters: Type2.Object(loginItemFields, { additionalProperties: false }),
+    execute: async (_id, params) => {
+      try {
+        const result = await createLoginVaultItem({ runner, item: params });
+        emitVaultwardenAudit(audit, "create_item", "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "create_item", "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createVaultwardenUpdateItemTool(runner, audit) {
+  const patchFields = {
+    name: Type2.Optional(Type2.String({ minLength: 1, maxLength: 256 })),
+    username: optionalNullableText("Replace username; null clears it, omitted fields remain unchanged."),
+    password: optionalNullableText("Replace password; null clears it, and it is never returned by this tool."),
+    uris: Type2.Optional(uriArray),
+    notes: optionalNullableText("Replace notes; null clears them, and they are never returned by this tool."),
+    folderId: Type2.Optional(Type2.Union([Type2.String({ pattern: UUID_PATTERN }), Type2.Null()])),
+    collectionIds: Type2.Optional(Type2.Array(uuidSchema, { maxItems: 100 })),
+    fields: Type2.Optional(fieldArray),
+    favorite: Type2.Optional(Type2.Boolean())
+  };
+  return {
+    name: "vaultwarden_update_item",
+    label: "Vaultwarden Update Login Item",
+    description: "Update supplied fields on one exact login item. Unspecified fields are preserved. Secret fields are sent to the local Bitwarden CLI over stdin and are never returned or audited. Use only when explicitly requested.",
+    parameters: Type2.Object(
+      { itemId: itemIdSchema, ...patchFields },
+      { additionalProperties: false }
+    ),
+    execute: async (_id, params) => {
+      try {
+        const { itemId, ...patch } = params;
+        const result = await updateLoginVaultItem({ runner, itemId, patch });
+        emitVaultwardenAudit(audit, "update_item", "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "update_item", "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createVaultwardenDeleteItemTool(runner, audit) {
+  return {
+    name: "vaultwarden_delete_item",
+    label: "Vaultwarden Delete Login Item",
+    description: "Soft-delete one login item. Requires confirmation equal to the exact item UUID; hard/permanent deletion is not supported. Use only when explicitly requested.",
+    parameters: Type2.Object(
+      {
+        itemId: itemIdSchema,
+        confirmation: Type2.String({ minLength: 1, description: "Must exactly match itemId." })
+      },
+      { additionalProperties: false }
+    ),
+    execute: async (_id, params) => {
+      try {
+        if (params.confirmation !== params.itemId) throw new Error("Confirmation mismatch");
+        const result = await deleteLoginVaultItem({ runner, itemId: params.itemId });
+        emitVaultwardenAudit(audit, "delete_item", "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "delete_item", "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createVaultwardenMutationTools(runner, enabled, audit) {
+  if (enabled !== true) return [];
+  return [
+    createVaultwardenCreateItemTool(runner, audit),
+    createVaultwardenUpdateItemTool(runner, audit),
+    createVaultwardenDeleteItemTool(runner, audit)
+  ];
+}
+function createVaultwardenSearchTool(runner, maxResults, audit) {
+  return {
+    name: "vaultwarden_search",
+    label: "Vaultwarden Search",
+    description: "Search Vaultwarden item metadata without returning passwords, TOTP seeds, or secure notes.",
+    parameters: Type2.Object(
+      { query: Type2.String({ minLength: 1, description: "Item name or metadata to search for." }) },
+      { additionalProperties: false }
+    ),
+    execute: async (_id, params) => {
+      try {
+        const result = await searchVaultItems({ runner, query: params.query, maxResults });
+        emitVaultwardenAudit(audit, "search", "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "search", "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createVaultwardenGetItemTool(runner, audit) {
+  return {
+    name: "vaultwarden_get_item",
+    label: "Vaultwarden Get Item",
+    description: "Retrieve one Vaultwarden item by ID, returning safe metadata only.",
+    parameters: Type2.Object(
+      { itemId: Type2.String({ minLength: 1, description: "Stable Vaultwarden item ID." }) },
+      { additionalProperties: false }
+    ),
+    execute: async (_id, params) => {
+      try {
+        const result = await getVaultItem({ runner, itemId: params.itemId });
+        emitVaultwardenAudit(audit, "get_item", "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, "get_item", "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createListTool(runner, object, maxResults, audit) {
+  const label = object === "folders" ? "Folders" : "Collections";
+  return {
+    name: `vaultwarden_list_${object}`,
+    label: `Vaultwarden ${label}`,
+    description: `List Vaultwarden ${object} metadata without returning vault item contents.`,
+    parameters: Type2.Object({}, { additionalProperties: false }),
+    execute: async () => {
+      try {
+        const result = await listVaultObjects({ runner, object, maxResults });
+        emitVaultwardenAudit(audit, `list_${object}`, "success");
+        return jsonToolResult(result);
+      } catch (error) {
+        emitVaultwardenAudit(audit, `list_${object}`, "error");
+        return errorToolResult(error);
+      }
+    }
+  };
+}
+function createVaultwardenListFoldersTool(runner, maxResults, audit) {
+  return createListTool(runner, "folders", maxResults, audit);
+}
+function createVaultwardenListCollectionsTool(runner, maxResults, audit) {
+  return createListTool(runner, "collections", maxResults, audit);
+}
+
+// index.ts
+var index_default = definePluginEntry({
+  id: "vaultwarden",
+  name: "Vaultwarden",
+  description: "Bitwarden-compatible Vaultwarden tools for OpenClaw",
+  register(api) {
+    api.registerCli?.(({ program }) => registerVaultwardenAuthCli(program), {
+      commands: ["vaultwarden"]
+    });
+    const config = api.pluginConfig;
+    const configuredSession = api.config.plugins?.entries?.vaultwarden?.config?.session;
+    const runner = createBitwardenCliRunner({
+      ...config,
+      session: configuredSession ?? config.session,
+      config: api.config,
+      onSessionResolution: (result) => api.logger.info(
+        JSON.stringify({
+          event: "vaultwarden_session_resolution",
+          ...result
+        })
+      )
+    });
+    const audit = (event) => {
+      api.logger.info(JSON.stringify(event));
+    };
+    api.registerTool(createVaultwardenStatusTool(runner, audit), { name: "vaultwarden_status" });
+    api.registerTool(createVaultwardenSearchTool(runner, config.maxResults ?? 20, audit), {
+      name: "vaultwarden_search"
+    });
+    api.registerTool(createVaultwardenGetItemTool(runner, audit), { name: "vaultwarden_get_item" });
+    api.registerTool(createVaultwardenListFoldersTool(runner, config.maxResults ?? 20, audit), {
+      name: "vaultwarden_list_folders"
+    });
+    api.registerTool(createVaultwardenListCollectionsTool(runner, config.maxResults ?? 20, audit), {
+      name: "vaultwarden_list_collections"
+    });
+    for (const tool of createVaultwardenMutationTools(runner, config.allowMutations === true, audit)) {
+      api.registerTool(tool, { name: tool.name });
+    }
+  }
+});
+export {
+  index_default as default
+};