@ouro.bot/cli 0.1.0-alpha.400 → 0.1.0-alpha.401

package/changelog.json

@@ -1,6 +1,16 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.401",
+      "changes": [
+        "Bitwarden-backed credential writes now prove success by reading the saved item back immediately and verifying its name, username, password, and notes before returning success.",
+        "Post-save verification now prefers `bw get item <id>` when create/edit returns a usable id, falls back cleanly when stdout is malformed or id-less, and retries once when the local Bitwarden session expires mid-verification.",
+        "Malformed or invalid `bw get item` responses now fail with short sanitized errors instead of leaving auth and vault save flows in an ambiguous half-success state.",
+        "Runtime auth's Bitwarden harness coverage now exercises the same post-save readback path as the real vault store, and the store test suite covers missing items, malformed responses, field-by-field mismatches, and multi-field mismatch guidance.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the vault write readback verification release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.400",
       "changes": [

package/dist/repertoire/bitwarden-store.js

@@ -184,6 +184,34 @@ function parseBwItems(stdout, context) {
         throw new Error(`bw CLI error: invalid JSON from ${context}`);
     }
 }
+function parseBwItem(stdout, context) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+        if (!isBwLoginItem(parsed)) {
+            throw new Error("expected login item");
+        }
+        return parsed;
+    }
+    catch {
+        if (parsed !== undefined) {
+            throw new Error(`bw CLI error: invalid item from ${context}`);
+        }
+        throw new Error(`bw CLI error: invalid JSON from ${context}`);
+    }
+}
+function parseBwItemId(stdout) {
+    try {
+        const parsed = JSON.parse(stdout);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const id = parsed.id;
+        return typeof id === "string" && id.trim().length > 0 ? id : null;
+    }
+    catch {
+        return null;
+    }
+}
 // ---------------------------------------------------------------------------
 // BitwardenCredentialStore
 // ---------------------------------------------------------------------------
@@ -387,12 +415,20 @@ class BitwardenCredentialStore {
                 notes: data.notes ?? null,
             };
             const encoded = Buffer.from(JSON.stringify(item)).toString("base64");
+            let savedItem;
             if (existing) {
-                await execBw(["edit", "item", existing.id], session, this.appDataDir, encoded);
+                const stdout = await execBw(["edit", "item", existing.id], session, this.appDataDir, encoded);
+                const savedItemId = parseBwItemId(stdout) ?? existing.id;
+                savedItem = await this.findItemById(savedItemId, session);
             }
             else {
-                await execBw(["create", "item"], session, this.appDataDir, encoded);
+                const stdout = await execBw(["create", "item"], session, this.appDataDir, encoded);
+                const savedItemId = parseBwItemId(stdout);
+                savedItem = savedItemId
+                    ? await this.findItemById(savedItemId, session)
+                    : await this.findItemByDomain(domain, session);
             }
+            this.assertStoredCredentialMatches(domain, data, savedItem);
         });
         (0, runtime_1.emitNervesEvent)({
             event: "repertoire.bw_credential_store_end",
@@ -457,5 +493,27 @@ class BitwardenCredentialStore {
         // Find exact match by name
         return items.find((item) => item.name === domain) ?? null;
     }
+    async findItemById(id, session) {
+        const stdout = await execBw(["get", "item", id], session, this.appDataDir);
+        return parseBwItem(stdout, "bw get item");
+    }
+    assertStoredCredentialMatches(domain, data, item) {
+        if (!item) {
+            throw new Error(`bw CLI error: credential save verification failed for ${domain}: saved item could not be read back after write`);
+        }
+        const mismatches = [];
+        if (item.name !== domain)
+            mismatches.push("name");
+        if ((item.login?.username ?? "") !== (data.username ?? ""))
+            mismatches.push("username");
+        if ((item.login?.password ?? "") !== data.password)
+            mismatches.push("password");
+        if ((item.notes ?? null) !== (data.notes ?? null))
+            mismatches.push("notes");
+        if (mismatches.length > 0) {
+            const label = mismatches.length === 1 ? "field" : "fields";
+            throw new Error(`bw CLI error: credential save verification failed for ${domain}: saved item did not match requested ${label} ${mismatches.join(", ")}`);
+        }
+    }
 }
 exports.BitwardenCredentialStore = BitwardenCredentialStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.400",
+  "version": "0.1.0-alpha.401",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",