@ouro.bot/cli 0.1.0-alpha.398 → 0.1.0-alpha.399

package/changelog.json

@@ -1,6 +1,16 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.399",
+      "changes": [
+        "Bitwarden-backed credential writes now pipe provider vault item payloads to `bw create item` and `bw edit item` over stdin instead of putting encoded credential JSON in process arguments.",
+        "Bitwarden CLI failures are now sanitized before they reach CLI output, so `Command failed: bw ...` argv, encoded payloads, raw provider tokens, and vault item passwords are not printed.",
+        "Bitwarden master-password prompts during credential writes now surface as a short locked/expired local session message instead of dumping the failed command invocation.",
+        "The nerves redaction audit now looks for credential-shaped text instead of failing on ordinary file paths or branch names that contain words like `secret`, `password`, or `api-key`.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the Bitwarden secret redaction release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.398",
       "changes": [

package/dist/nerves/coverage/contract.js

@@ -12,11 +12,11 @@ exports.REQUIRED_ENVELOPE_FIELDS = [
     "meta",
 ];
 exports.SENSITIVE_PATTERNS = [
-    /\btoken\s*[:=]/i,
-    /\bapi[_-]?key\b/i,
-    /\bpassword\b/i,
-    /\bsecret\b/i,
-    /\bauthorization\b/i,
+    /\btoken\b["']?\s*[:=]/i,
+    /\bapi[_-]?key\b["']?\s*[:=]/i,
+    /\bpassword\b["']?\s*[:=]/i,
+    /\bsecret\b["']?\s*[:=]/i,
+    /\bauthorization\b["']?\s*[:=]/i,
 ];
 function eventKey(component, event) {
     return `${component}:${event}`;

package/dist/repertoire/bitwarden-store.js

@@ -49,24 +49,44 @@ const bw_installer_1 = require("./bw-installer");
 // ---------------------------------------------------------------------------
 // bw CLI wrapper
 // ---------------------------------------------------------------------------
-function execBw(args, sessionToken, appDataDir) {
+function sanitizeBwErrorDetail(message) {
+    if (/master password/i.test(message)) {
+        return "bw CLI requested a master password; the local Bitwarden session is locked or expired";
+    }
+    const withoutCommandLine = message
+        .split(/\r?\n/)
+        .filter((line) => !line.trim().startsWith("Command failed:"))
+        .join("\n")
+        .trim();
+    return (withoutCommandLine || "command failed")
+        .replace(/[A-Za-z0-9+/=]{80,}/g, "[redacted]")
+        .slice(0, 500);
+}
+function formatBwCliError(err, stderr = "") {
+    const detail = sanitizeBwErrorDetail(stderr.trim() || err.message);
+    return new Error(`bw CLI error: ${detail}`);
+}
+function execBw(args, sessionToken, appDataDir, stdin) {
     const env = {
         ...process.env,
         ...(sessionToken ? { BW_SESSION: sessionToken } : {}),
         ...(appDataDir ? { BITWARDENCLI_APPDATA_DIR: appDataDir } : {}),
     };
     return new Promise((resolve, reject) => {
-        (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout) => {
+        const child = (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout, stderr) => {
             if (err) {
                 if (isBwNotInstalled(err)) {
                     reject(new Error("bw CLI not found. Install from https://bitwarden.com/help/cli/"));
                     return;
                 }
-                reject(new Error(`bw CLI error: ${err.message}`));
+                reject(formatBwCliError(err, stderr));
                 return;
             }
             resolve(stdout);
         });
+        if (stdin !== undefined) {
+            child?.stdin?.end(stdin);
+        }
     });
 }
 /** Check if the error indicates the bw CLI binary is not installed. */
@@ -275,10 +295,10 @@ class BitwardenCredentialStore {
         };
         const encoded = Buffer.from(JSON.stringify(item)).toString("base64");
         if (existing) {
-            await execBw(["edit", "item", existing.id, encoded], session, this.appDataDir);
+            await execBw(["edit", "item", existing.id], session, this.appDataDir, encoded);
         }
         else {
-            await execBw(["create", "item", encoded], session, this.appDataDir);
+            await execBw(["create", "item"], session, this.appDataDir, encoded);
         }
         (0, runtime_1.emitNervesEvent)({
             event: "repertoire.bw_credential_store_end",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.398",
+  "version": "0.1.0-alpha.399",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",