@arloraccoon/openclaw-vaultwarden-plugin 0.1.0

package/dist/secret-resolver.mjs

@@ -0,0 +1,228 @@
+// src/secret-resolver-cli.ts
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+var MAX_ITEM_OUTPUT_BYTES = 1024 * 1024;
+var CLI_TIMEOUT_MS = 1e4;
+function runBitwardenGetItem(itemId, session, options = {}) {
+  return new Promise((resolve, reject) => {
+    const fail = () => reject(new Error("Bitwarden item lookup failed"));
+    let child;
+    try {
+      child = (options.spawnProcess ?? spawn)(
+        "bw",
+        ["get", "item", itemId],
+        {
+          shell: false,
+          env: {
+            PATH: process.env.PATH ?? "/usr/bin:/bin",
+            HOME: process.env.HOME ?? homedir(),
+            ...process.env.TMPDIR ? { TMPDIR: process.env.TMPDIR } : {},
+            ...process.env.BITWARDENCLI_APPDATA_DIR ? { BITWARDENCLI_APPDATA_DIR: process.env.BITWARDENCLI_APPDATA_DIR } : {},
+            BW_SESSION: session
+          },
+          stdio: ["ignore", "pipe", "ignore"]
+        }
+      );
+    } catch {
+      fail();
+      return;
+    }
+    const chunks = [];
+    let outputBytes = 0;
+    let settled = false;
+    const finishError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fail();
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finishError();
+    }, options.timeoutMs ?? CLI_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      outputBytes += data.length;
+      if (outputBytes > (options.maxOutputBytes ?? MAX_ITEM_OUTPUT_BYTES)) {
+        child.kill("SIGKILL");
+        finishError();
+        return;
+      }
+      chunks.push(data);
+    });
+    child.on("error", finishError);
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (code !== 0) {
+        fail();
+        return;
+      }
+      try {
+        const item = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!item || typeof item !== "object" || Array.isArray(item)) throw new Error("invalid item");
+        resolve(item);
+      } catch {
+        fail();
+      }
+    });
+  });
+}
+
+// src/secret-resolver.ts
+import { closeSync, constants, fstatSync, openSync, readFileSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join } from "node:path";
+var MAX_REQUEST_BYTES = 64 * 1024;
+var MAX_BATCH_SIZE = 20;
+var MAX_SESSION_BYTES = 4096;
+var MAX_VALUE_BYTES = 24 * 1024;
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function errorResponse(ids = ["*"]) {
+  return {
+    protocolVersion: 1,
+    values: {},
+    errors: Object.fromEntries(ids.map((id) => [id, "Unable to resolve secret"]))
+  };
+}
+function parseSelector(id) {
+  const match = /^([^/]+)\/(password|field\/(.+))$/.exec(id);
+  if (!match || !UUID.test(match[1])) return void 0;
+  if (match[2] === "password") return { itemId: match[1], kind: "password" };
+  const name = match[3];
+  if (!name || name.length > 256 || /[\u0000-\u001f\u007f/]/.test(name) || name.trim() !== name) return void 0;
+  return { itemId: match[1], kind: "field", name };
+}
+function readSession(env, homeDirectory) {
+  if (Object.hasOwn(env, "BW_SESSION")) {
+    const session = env.BW_SESSION;
+    if (!session || session.length > MAX_SESSION_BYTES || /\s/.test(session)) {
+      throw new Error("invalid session");
+    }
+    return session;
+  }
+  const path = env.VAULTWARDEN_SESSION_FILE || join(homeDirectory, ".openclaw", "secrets", "vaultwarden-session");
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size < 1 || stat.size > MAX_SESSION_BYTES) {
+      throw new Error("invalid session file");
+    }
+    if (typeof process.getuid === "function" && stat.uid !== process.getuid() || (stat.mode & 63) !== 0) {
+      throw new Error("unsafe session file");
+    }
+    const contents = readFileSync(fd, "utf8");
+    const session = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
+    if (!session || /\s/.test(session) || Buffer.byteLength(session, "utf8") > MAX_SESSION_BYTES) {
+      throw new Error("invalid session file");
+    }
+    return session;
+  } finally {
+    closeSync(fd);
+  }
+}
+function selectValue(item, selector) {
+  const checked = (value) => {
+    if (Buffer.byteLength(value, "utf8") > MAX_VALUE_BYTES) throw new Error("value too large");
+    return value;
+  };
+  if (item.id !== selector.itemId) throw new Error("item mismatch");
+  if (selector.kind === "password") {
+    if (typeof item.login?.password !== "string" || !item.login.password) throw new Error("password missing");
+    return checked(item.login.password);
+  }
+  const matches = (item.fields ?? []).filter((field2) => field2.name === selector.name);
+  if (matches.length !== 1) throw new Error("field missing or ambiguous");
+  const [field] = matches;
+  if (field?.type !== 0 && field?.type !== 1 && field?.type !== "text" && field?.type !== "hidden" || typeof field.value !== "string" || !field.value) {
+    throw new Error("field unsupported");
+  }
+  return checked(field.value);
+}
+async function resolveSecretRequest(rawInput, options = {}) {
+  if (Buffer.byteLength(rawInput, "utf8") > MAX_REQUEST_BYTES) return errorResponse();
+  let body;
+  try {
+    body = JSON.parse(rawInput);
+  } catch {
+    return errorResponse();
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) return errorResponse();
+  const request = body;
+  if (request.protocolVersion !== 1 || !Array.isArray(request.ids) || request.ids.length < 1 || request.ids.length > MAX_BATCH_SIZE || request.ids.some((id) => typeof id !== "string" || id.length > 512 || !parseSelector(id))) {
+    return errorResponse();
+  }
+  const ids = request.ids;
+  const selectors = ids.map((id) => parseSelector(id));
+  let session;
+  try {
+    session = readSession(options.env ?? process.env, options.homeDirectory ?? homedir2());
+  } catch {
+    return errorResponse(ids);
+  }
+  const values = {};
+  const errors = {};
+  const itemCache = /* @__PURE__ */ new Map();
+  for (let index = 0; index < ids.length; index += 1) {
+    const id = ids[index];
+    const selector = selectors[index];
+    try {
+      let itemPromise = itemCache.get(selector.itemId);
+      if (!itemPromise) {
+        const getItem = options.getItem;
+        if (!getItem) throw new Error("resolver unavailable");
+        itemPromise = getItem(selector.itemId, session);
+        itemCache.set(selector.itemId, itemPromise);
+      }
+      values[id] = selectValue(await itemPromise, selector);
+    } catch {
+      errors[id] = "Unable to resolve secret";
+    }
+  }
+  const response = { protocolVersion: 1, values, errors };
+  if (Buffer.byteLength(JSON.stringify(response), "utf8") > MAX_RESPONSE_BYTES) {
+    return errorResponse(ids);
+  }
+  itemCache.clear();
+  return response;
+}
+
+// src/secret-resolver-protocol.ts
+async function runResolverProtocol(rawInput, options = {}) {
+  return JSON.stringify(await resolveSecretRequest(rawInput, options));
+}
+
+// src/secret-resolver-entry.ts
+async function main() {
+  let rawInput = "";
+  let inputBytes = 0;
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) {
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    inputBytes += Buffer.byteLength(text, "utf8");
+    if (inputBytes > MAX_REQUEST_BYTES) {
+      process.stdout.write(JSON.stringify({
+        protocolVersion: 1,
+        values: {},
+        errors: { "*": "Unable to resolve secret" }
+      }));
+      return;
+    }
+    rawInput += text;
+  }
+  const result = await runResolverProtocol(rawInput, {
+    env: process.env,
+    getItem: async (itemId, session) => runBitwardenGetItem(itemId, session)
+  });
+  process.stdout.write(result);
+}
+void main().catch(() => {
+  process.stdout.write(JSON.stringify({
+    protocolVersion: 1,
+    values: {},
+    errors: { "*": "Unable to resolve secret" }
+  }));
+  process.exitCode = 1;
+});

package/openclaw.plugin.json

@@ -0,0 +1,89 @@
+{
+  "id": "vaultwarden",
+  "name": "Vaultwarden",
+  "description": "Metadata-safe Bitwarden-compatible Vaultwarden tools for OpenClaw with opt-in item mutations",
+  "secretProviderIntegrations": {
+    "vaultwarden": {
+      "displayName": "Vaultwarden",
+      "source": "exec",
+      "command": "${node}",
+      "args": ["./dist/secret-resolver.mjs"],
+      "passEnv": ["BW_SESSION", "VAULTWARDEN_SESSION_FILE", "PATH"],
+      "timeoutMs": 15000,
+      "maxOutputBytes": 65536,
+      "jsonOnly": true
+    }
+  },
+  "activation": {
+    "onStartup": false
+  },
+  "contracts": {
+    "tools": [
+      "vaultwarden_status",
+      "vaultwarden_search",
+      "vaultwarden_get_item",
+      "vaultwarden_list_folders",
+      "vaultwarden_list_collections",
+      "vaultwarden_create_item",
+      "vaultwarden_update_item",
+      "vaultwarden_delete_item"
+    ]
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "adapter": {
+        "type": "string",
+        "enum": ["cli"]
+      },
+      "sessionEnv": {
+        "type": "string",
+        "minLength": 1
+      },
+      "session": {
+        "description": "Bitwarden CLI session token; prefer an OpenClaw SecretRef.",
+        "oneOf": [
+          {
+            "type": "string",
+            "minLength": 1
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["source", "provider", "id"],
+            "properties": {
+              "source": {
+                "type": "string",
+                "enum": ["env", "file", "exec"]
+              },
+              "provider": {
+                "type": "string",
+                "minLength": 1
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      },
+      "timeoutSeconds": {
+        "type": "number",
+        "minimum": 1,
+        "maximum": 120
+      },
+      "maxResults": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 100
+      },
+      "allowMutations": {
+        "type": "boolean",
+        "default": false,
+        "description": "Register login-item create, update, and soft-delete tools. Disabled by default."
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@arloraccoon/openclaw-vaultwarden-plugin",
+  "version": "0.1.0",
+  "description": "Metadata-safe Vaultwarden tools for OpenClaw with opt-in item mutations",
+  "scripts": {
+    "build": "esbuild index.ts --bundle --platform=node --format=esm --external:openclaw '--external:openclaw/*' --external:typebox --outfile=dist/index.mjs && esbuild src/secret-resolver-entry.ts --bundle --platform=node --format=esm --outfile=dist/secret-resolver.mjs",
+    "test": "vitest run src/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings 0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ArloTheRaccoon/openclaw-vaultwarden-plugin"
+  },
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "files": [
+    "dist/**",
+    "openclaw.plugin.json",
+    "README.md",
+    "package.json"
+  ],
+  "dependencies": {
+    "typebox": "1.1.38"
+  },
+  "peerDependencies": {
+    "openclaw": ">=2026.9.5"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.3",
+    "esbuild": "0.28.0",
+    "eslint": "^10.11.0",
+    "playwright": "^1.63.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.70.1",
+    "vitest": "4.1.6"
+  },
+  "openclaw": {
+    "extensions": [
+      "./dist/index.mjs"
+    ],
+    "install": {
+      "npmSpec": "@arloraccoon/openclaw-vaultwarden-plugin",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.9.5"
+    },
+    "compat": {
+      "pluginApi": ">=2026.5.19"
+    },
+    "release": {
+      "publishToNpm": true,
+      "publishToClawHub": true
+    }
+  }
+}