@icoretech/warden-mcp 0.1.15 → 0.1.17

package/README.md

@@ -62,12 +62,14 @@ BW_BIN=/absolute/path/to/bw npx -y @icoretech/warden-mcp@latest
 `warden-mcp` intentionally bundles a vetted `@bitwarden/cli` version instead of
 blindly following the newest upstream CLI on every release. New `bw` releases
 can change login and unlock behavior in ways that break automation, so `bw`
-upgrades should be smoke-tested against real Vaultwarden and Bitwarden flows
-before bumping the bundled version.
+upgrades should be smoke-tested against real Vaultwarden flows before bumping
+the bundled version. Official Bitwarden compatibility is intended, but it is
+not continuously proven in CI without a real Bitwarden tenant.
 
-This repository's compose smoke now exercises both username/password auth and
-user API-key auth against a real local Vaultwarden so `@bitwarden/cli` bumps do
-not rely on unit coverage alone.
+This repository's compose smoke now exercises both direct `bw` auth flows and
+the MCP/SDK layers with username/password auth plus user API-key auth against a
+real local Vaultwarden, so `@bitwarden/cli` bumps do not rely on unit coverage
+alone.
 
 ## Install And Run
 
@@ -456,7 +458,8 @@ Run integration tests:
 make test
 ```
 
-`make test` now runs both compose-backed auth paths:
+`make test` now runs both compose-backed auth paths and verifies them at the
+raw CLI plus MCP/SDK layers:
 
 - user/password login from `.env.test`
 - api-key login from `tmp/vaultwarden-bootstrap/apikey.env`, generated by the bootstrap step and kept out of git via `tmp/`

package/bin/warden-mcp.js

@@ -3,8 +3,7 @@
 // bin/warden-mcp.js — CLI entry for @icoretech/warden-mcp
 
 import { spawnSync } from 'node:child_process';
-import { accessSync, constants, existsSync, readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
+import { existsSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -13,20 +12,12 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 // Resolve bw binary: optional dep → system PATH
 if (!process.env.BW_BIN) {
   try {
-    const require = createRequire(import.meta.url);
-    const { resolveBundledBwCandidate } = await import(
+    const { resolveBundledBwBin } = await import(
       resolve(__dirname, '../dist/bw/resolveBwBin.js')
     );
-    const pkgManifest = require.resolve('@bitwarden/cli/package.json');
-    const pkgJson = JSON.parse(readFileSync(pkgManifest, 'utf8'));
-    const candidate = resolveBundledBwCandidate(pkgManifest, pkgJson.bin);
-    if (existsSync(candidate)) {
-      try {
-        accessSync(candidate, constants.X_OK);
-        process.env.BW_BIN = candidate;
-      } catch {
-        // Not executable — fall through to system bw
-      }
+    const candidate = resolveBundledBwBin();
+    if (candidate) {
+      process.env.BW_BIN = candidate;
     }
   } catch {
     // @bitwarden/cli optional dep not installed — fall through to system bw

package/dist/bw/bwCli.js

@@ -1,5 +1,6 @@
 // src/bw/bwCli.ts
 import { spawn } from 'node:child_process';
+import { resolveBundledBwBin } from './resolveBwBin.js';
 export class BwCliError extends Error {
     exitCode;
     stdout;
@@ -13,7 +14,7 @@ export class BwCliError extends Error {
     }
 }
 export async function runBw(args, opts = {}) {
-    const bwBin = process.env.BW_BIN ?? 'bw';
+    const bwBin = process.env.BW_BIN ?? resolveBundledBwBin() ?? 'bw';
     // Ensure the CLI never blocks waiting for a prompt (e.g. master password).
     // This is critical for running as an MCP server / in test automation.
     const injectNoInteraction = opts.noInteraction ?? true;

package/dist/bw/bwSession.js

@@ -3,6 +3,11 @@ import { rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { runBw } from './bwCli.js';
 import { Mutex } from './mutex.js';
+const POST_LOGIN_UNLOCK_RETRY_ATTEMPTS = 20;
+const POST_LOGIN_UNLOCK_RETRY_DELAY_MS = 2_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function requiredEnv(name) {
     const v = process.env[name];
     if (!v) {
@@ -188,7 +193,7 @@ export class BwSessionManager {
                         timeoutMs: 60_000,
                         noInteraction: false,
                     });
-                    return stdout.trim();
+                    return { completed: true, session: stdout.trim() };
                 }
                 const { stdout } = await runBw([
                     'login',
@@ -197,17 +202,35 @@ export class BwSessionManager {
                     'BW_PASSWORD',
                     '--raw',
                 ], { env: unlockEnv, timeoutMs: 60_000, noInteraction: false });
-                return stdout.trim();
+                return { completed: true, session: stdout.trim() };
             }
             catch {
-                return '';
+                return { completed: false, session: '' };
+            }
+        };
+        const retryUnlockAfterLogin = async () => {
+            for (let attempt = 0; attempt < POST_LOGIN_UNLOCK_RETRY_ATTEMPTS; attempt += 1) {
+                const session = await tryUnlock();
+                if (session)
+                    return session;
+                if (attempt < POST_LOGIN_UNLOCK_RETRY_ATTEMPTS - 1) {
+                    await sleep(POST_LOGIN_UNLOCK_RETRY_DELAY_MS);
+                }
             }
+            return '';
         };
         // Prefer unlocking first (works when already logged in). If it yields an empty
         // stdout on exit=0 (observed in some bw builds), fall back to login --raw.
         let session = await tryUnlock();
-        if (!session)
-            session = await tryLoginRaw();
+        if (!session) {
+            const login = await tryLoginRaw();
+            if (login.session) {
+                session = login.session;
+            }
+            else if (login.completed) {
+                session = await retryUnlockAfterLogin();
+            }
+        }
         if (!session)
             session = await tryUnlock();
         if (!session)

package/dist/bw/resolveBwBin.js

@@ -1,3 +1,5 @@
+import { accessSync, constants, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 export function resolveBundledBwCandidate(pkgManifestPath, pkgBin) {
     const pkgDir = dirname(pkgManifestPath);
@@ -8,3 +10,15 @@ export function resolveBundledBwCandidate(pkgManifestPath, pkgBin) {
             : 'dist/bw';
     return join(pkgDir, binEntry);
 }
+export function resolveBundledBwBin(resolvePackage = createRequire(import.meta.url).resolve) {
+    try {
+        const pkgManifestPath = resolvePackage('@bitwarden/cli/package.json');
+        const pkgJson = JSON.parse(readFileSync(pkgManifestPath, 'utf8'));
+        const candidate = resolveBundledBwCandidate(pkgManifestPath, pkgJson.bin);
+        accessSync(candidate, constants.X_OK);
+        return candidate;
+    }
+    catch {
+        return null;
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@icoretech/warden-mcp",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "license": "MIT",
   "description": "Vaultwarden/Bitwarden MCP server backed by Bitwarden CLI (bw).",