@arloraccoon/openclaw-vaultwarden-plugin 0.1.2 → 0.1.3

package/README.md

@@ -59,6 +59,7 @@ cd "$REPO_DIR"
 git pull --ff-only
 pnpm install --frozen-lockfile
 pnpm build
+pnpm test:package
 openclaw plugins install "$REPO_DIR" --link --force --accept-capabilities
 openclaw config validate
 openclaw plugins reload vaultwarden --accept-capabilities
@@ -324,3 +325,12 @@ SecretRef provider); OpenClaw's `plugins validate` authoring check is for
 `defineToolPlugin`-style tool-only packages. Use the installed runtime smoke
 test for this package instead of treating that tool-only check as a generic
 plugin validity gate.
+
+## Release synchronization
+
+Forgejo is the canonical development repository; the public GitHub mirror
+excludes `.beads/`, `.crew/`, and generated `dist/` files. npm and ClawHub must
+carry the same semver version. Release tags run `publish-npm.yml` through npm
+Trusted Publishing (OIDC); do not add registry tokens to GitHub secrets. Run
+`RELEASE-CHECKLIST.md` before creating a tag and verify both registries after
+publication.

package/dist/index.mjs

@@ -186,25 +186,51 @@ function sessionRecoverySource(session, sessionEnv, inherited) {
   return inherited[sessionEnv] ? "env" : "default";
 }
 function recoveryInstruction(source) {
+  const statusCheck = "First verify the host with `bw status --raw`;";
   switch (source) {
     case "file":
-      return "Refresh the file configured for the Vaultwarden SecretRef, then retry. For a single-value file provider, run `openclaw vaultwarden --session-file <configured-path>` in a trusted terminal; do not use that command on a JSON provider file.";
+      return `${statusCheck} Refresh the file configured for the Vaultwarden SecretRef, then retry. For a single-value file provider, run \`openclaw vaultwarden --session-file <configured-path>\` in a trusted terminal; do not use that command on a JSON provider file.`;
     case "env":
-      return "Refresh the configured environment SecretRef in the Gateway's environment, then retry. `openclaw vaultwarden` writes a local file and does not replace an environment SecretRef.";
+      return `${statusCheck} Refresh the configured environment SecretRef in the Gateway's environment, then retry. \`openclaw vaultwarden\` writes a local file and does not replace an environment SecretRef.`;
     case "exec":
     case "store":
-      return "Refresh the configured SecretRef at its provider, then retry. `openclaw vaultwarden` writes a local file and does not update that provider.";
+      return `${statusCheck} Refresh the configured SecretRef at its provider, then retry. \`openclaw vaultwarden\` writes a local file and does not update that provider.`;
     case "inline":
-      return "Replace the configured session value with a freshly unlocked session using a secure local configuration path; do not paste it into chat. `openclaw vaultwarden` writes a local file but does not change inline configuration.";
+      return `${statusCheck} Replace the configured session value with a freshly unlocked session using a secure local configuration path; do not paste it into chat. \`openclaw vaultwarden\` writes a local file but does not change inline configuration.`;
     default:
-      return "On the OpenClaw host, run `openclaw vaultwarden` in a trusted terminal to create the default local session file, then configure the plugin session as a file SecretRef to that file and retry. The CLI does not read the file automatically.";
+      return `${statusCheck} On the OpenClaw host, run \`openclaw vaultwarden\` in a trusted terminal to create the default local session file, then configure the plugin session as a file SecretRef to that file and retry. The CLI does not read the file automatically.`;
   }
 }
 var sessionFailurePattern = /(?:session|token|authentication|credential).{0,48}(?:expired|invalid|unauthori[sz]ed|rejected|not valid)|(?:expired|invalid|unauthori[sz]ed|rejected).{0,48}(?:session|token|credential)|not logged in|you are not logged in|vault is locked|vault must be unlocked|\b401\b/i;
+function classifySessionFailure(error) {
+  const text = cliErrorText(error);
+  if (!sessionFailurePattern.test(text)) return void 0;
+  if (/expired|session.*(?:invalid|not valid)|(?:invalid|not valid).*session/i.test(text)) {
+    return "expired";
+  }
+  if (/vault (?:is )?locked|vault must be unlocked|locked/i.test(text)) return "locked";
+  if (/not logged in|unauthenticated|\b401\b|unauthori[sz]ed/i.test(text)) {
+    return "unauthenticated";
+  }
+  return "unavailable";
+}
+function sessionFailurePrefix(kind) {
+  switch (kind) {
+    case "locked":
+      return "Vaultwarden vault is locked";
+    case "unauthenticated":
+      return "Vaultwarden authentication is unavailable";
+    case "unavailable":
+      return "Vaultwarden session could not be used";
+    default:
+      return "Vaultwarden session is expired";
+  }
+}
 function redactCliError(error) {
-  if (sessionFailurePattern.test(cliErrorText(error))) {
+  const failureKind = classifySessionFailure(error);
+  if (failureKind) {
     const source = error && typeof error === "object" && "recoverySource" in error ? error.recoverySource : void 0;
-    return `Vaultwarden session is unavailable or expired. ${recoveryInstruction(source ?? "default")} The plugin will not prompt for or expose the master password.`;
+    return `${sessionFailurePrefix(failureKind)}. ${recoveryInstruction(source ?? "default")} The plugin will not prompt for or expose the master password.`;
   }
   return "Vaultwarden CLI command failed";
 }
@@ -284,12 +310,13 @@ import { Type } from "typebox";
 import { textResult } from "openclaw/plugin-sdk/tool-results";
 
 // src/audit.ts
-function emitVaultwardenAudit(audit, operation, outcome) {
+function emitVaultwardenAudit(audit, operation, outcome, itemId) {
   if (!audit) {
     return;
   }
   try {
-    audit({ event: "vaultwarden.tool", operation, outcome });
+    const safeItemId = itemId && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(itemId) ? itemId : void 0;
+    audit({ event: "vaultwarden.tool", operation, outcome, ...safeItemId ? { itemId: safeItemId } : {} });
   } catch {
   }
 }
@@ -323,6 +350,22 @@ import { textResult as textResult2 } from "openclaw/plugin-sdk/tool-results";
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var MAX_ITEM_BYTES = 64 * 1024;
 var MAX_SECRET_BYTES = 24 * 1024;
+var mutationLocks = /* @__PURE__ */ new Map();
+async function withMutationLock(itemId, operation) {
+  const previous = mutationLocks.get(itemId) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve2) => {
+    release = resolve2;
+  });
+  mutationLocks.set(itemId, current);
+  await previous;
+  try {
+    return await operation();
+  } finally {
+    release();
+    if (mutationLocks.get(itemId) === current) mutationLocks.delete(itemId);
+  }
+}
 function checkedString(value, label, maxBytes = MAX_SECRET_BYTES) {
   if (typeof value !== "string" || !value.trim() || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value) || Buffer.byteLength(value, "utf8") > maxBytes) {
     throw new Error(`Invalid ${label}`);
@@ -444,15 +487,19 @@ async function createLoginVaultItem(params) {
 }
 async function updateLoginVaultItem(params) {
   const itemId = checkedId(params.itemId, "item ID");
-  const current = await params.runner(["get", "item", itemId]);
-  const item = mergeLoginVaultItem(JSON.parse(current.stdout), params.patch);
-  const result = await params.runner(["edit", "item", itemId], encodeVaultItem(item));
-  return parseMutationItem(result.stdout);
+  return withMutationLock(itemId, async () => {
+    const current = await params.runner(["get", "item", itemId]);
+    const item = mergeLoginVaultItem(JSON.parse(current.stdout), params.patch);
+    const result = await params.runner(["edit", "item", itemId], encodeVaultItem(item));
+    return parseMutationItem(result.stdout);
+  });
 }
 async function deleteLoginVaultItem(params) {
   const itemId = checkedId(params.itemId, "item ID");
-  await params.runner(["delete", "item", itemId]);
-  return { id: itemId, deleted: true };
+  return withMutationLock(itemId, async () => {
+    await params.runner(["delete", "item", itemId]);
+    return { id: itemId, deleted: true };
+  });
 }
 function stringValue(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -596,10 +643,10 @@ function createVaultwardenUpdateItemTool(runner, audit) {
       try {
         const { itemId, ...patch } = params;
         const result = await updateLoginVaultItem({ runner, itemId, patch });
-        emitVaultwardenAudit(audit, "update_item", "success");
+        emitVaultwardenAudit(audit, "update_item", "success", itemId);
         return jsonToolResult(result);
       } catch (error) {
-        emitVaultwardenAudit(audit, "update_item", "error");
+        emitVaultwardenAudit(audit, "update_item", "error", params.itemId);
         return errorToolResult(error);
       }
     }
@@ -621,10 +668,10 @@ function createVaultwardenDeleteItemTool(runner, audit) {
       try {
         if (params.confirmation !== params.itemId) throw new Error("Confirmation mismatch");
         const result = await deleteLoginVaultItem({ runner, itemId: params.itemId });
-        emitVaultwardenAudit(audit, "delete_item", "success");
+        emitVaultwardenAudit(audit, "delete_item", "success", params.itemId);
         return jsonToolResult(result);
       } catch (error) {
-        emitVaultwardenAudit(audit, "delete_item", "error");
+        emitVaultwardenAudit(audit, "delete_item", "error", params.itemId);
         return errorToolResult(error);
       }
     }

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@arloraccoon/openclaw-vaultwarden-plugin",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Metadata-safe Vaultwarden tools for OpenClaw with opt-in item mutations",
   "scripts": {
     "build": "esbuild index.ts --bundle --platform=node --format=esm --external:openclaw '--external:openclaw/*' --external:typebox --outfile=dist/index.mjs && esbuild src/secret-resolver-entry.ts --bundle --platform=node --format=esm --outfile=dist/secret-resolver.mjs",
     "test": "vitest run src/*.test.ts",
+    "test:package": "bash tests/package-smoke.sh",
     "typecheck": "tsc --noEmit",
     "lint": "eslint . --max-warnings 0"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/ArloTheRaccoon/openclaw-vaultwarden-plugin"
+    "url": "git+https://github.com/ArloTheRaccoon/openclaw-vaultwarden-plugin.git"
   },
+  "packageManager": "pnpm@10.33.2",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.mjs",