@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.920

package/dist/repertoire/bitwarden-store.js

@@ -0,0 +1,1201 @@
+"use strict";
+/**
+ * Bitwarden CLI credential store — wraps `bw` CLI for the agent's own vault.
+ *
+ * This store authenticates directly as the agent using its own master password.
+ * The agent owns the vault, so no human-in-the-loop is needed.
+ *
+ * Requires the `bw` CLI to be installed. Session tokens are cached process-local.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BitwardenCredentialStore = void 0;
+exports.sanitizeCredentialErrorDetail = sanitizeCredentialErrorDetail;
+exports.readBwCliVersion = readBwCliVersion;
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const bw_installer_1 = require("./bw-installer");
+const MAX_ERROR_DETAIL_LENGTH = 500;
+const LONG_ENCODED_TOKEN_PATTERN = /[A-Za-z0-9+/=]{32,}/g;
+const BW_PASSWORD_ENV = "OURO_BW_MASTER_PASSWORD";
+function uniqueSecrets(secrets) {
+    return [...new Set(secrets.filter((value) => typeof value === "string" && value.length >= 4))].sort((left, right) => right.length - left.length);
+}
+function sanitizeCredentialErrorDetail(message, options = {}) {
+    const filtered = message
+        .split(/\r?\n/)
+        .filter((line) => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("Command failed:"))
+            return false;
+        if (trimmed.includes("[input is hidden]"))
+            return false;
+        return true;
+    })
+        .join("\n")
+        .trim();
+    let sanitized = filtered || "command failed";
+    for (const secret of uniqueSecrets(options.secrets ?? [])) {
+        sanitized = sanitized.split(secret).join("[redacted]");
+    }
+    sanitized = sanitized.replace(LONG_ENCODED_TOKEN_PATTERN, "[redacted]");
+    if (sanitized.replace(/\[redacted\]/g, "").trim().length === 0) {
+        return "command failed";
+    }
+    return sanitized.slice(0, MAX_ERROR_DETAIL_LENGTH);
+}
+// ---------------------------------------------------------------------------
+// bw CLI wrapper
+// ---------------------------------------------------------------------------
+function isBwSessionUnavailableMessage(message) {
+    return (/master password/i.test(message) ||
+        /vault is locked/i.test(message) ||
+        /not logged in/i.test(message) ||
+        /session key/i.test(message) ||
+        /local bitwarden session/i.test(message));
+}
+function isBwInvalidUnlockSecretMessage(message) {
+    return (/invalid master password/i.test(message) ||
+        /saved vault unlock secret/i.test(message) ||
+        /username or password is incorrect/i.test(message));
+}
+function isBwTimeoutError(err) {
+    const timeoutErr = err;
+    const message = err.message.toLowerCase();
+    return (timeoutErr.code === "ETIMEDOUT" ||
+        timeoutErr.killed === true ||
+        timeoutErr.signal === "SIGTERM" ||
+        message.includes("timed out"));
+}
+function formatBwOperation(args) {
+    const [command, target] = args;
+    /* v8 ignore next -- defensive: all execBw call sites pass a concrete bw subcommand @preserve */
+    if (!command)
+        return "bw command";
+    return [command, target].filter(Boolean).join(" ");
+}
+function sanitizeBwErrorDetail(message) {
+    if (isBwInvalidUnlockSecretMessage(message)) {
+        return "bw CLI rejected the saved vault unlock secret for this machine";
+    }
+    if (isBwSessionUnavailableMessage(message)) {
+        return "bw CLI could not use the local Bitwarden session because it is locked, missing, or expired";
+    }
+    return sanitizeCredentialErrorDetail(message);
+}
+function formatBwCliError(err, stderr = "", args = []) {
+    const operation = formatBwOperation(args);
+    if (isBwTimeoutError(err)) {
+        return new Error(`bw CLI error: ${operation} timed out -- usually resolves on retry. If it persists, check network connectivity to the vault server.`);
+    }
+    const detail = sanitizeBwErrorDetail(stderr.trim() || err.message);
+    if (detail === "command failed") {
+        return new Error(`bw CLI error: ${operation} failed without error detail`);
+    }
+    return new Error(`bw CLI error: ${detail}`);
+}
+function isBwSessionAuthError(err) {
+    return isBwSessionUnavailableMessage(err.message) || isBwInvalidUnlockSecretMessage(err.message);
+}
+function isBwConfigLogoutRequired(err) {
+    const message = err.message.toLowerCase();
+    return message.includes("logout") && message.includes("required");
+}
+function isBwAlreadyLoggedInError(err) {
+    return err.message.toLowerCase().includes("already logged in");
+}
+function isBwLoggedOutOrUnauthenticatedError(err) {
+    const message = err.message.toLowerCase();
+    return (message.includes("not logged in") ||
+        message.includes("not authenticated") ||
+        message.includes("unauthenticated") ||
+        message.includes("local bitwarden session because it is locked, missing, or expired"));
+}
+function shouldUseStructuredItemLookup(domain) {
+    return domain.includes("/");
+}
+// ---------------------------------------------------------------------------
+// Cross-process bw CLI lock
+// ---------------------------------------------------------------------------
+// The bw CLI cannot handle concurrent access to the same app data directory.
+// Two processes (e.g. daemon worker + ouro up CLI) hitting the same dir
+// simultaneously corrupt bw's local state, producing empty/garbled output.
+//
+// We use two layers:
+//   1. In-process async mutex: a Map<string, Promise<void>> keyed by appDataDir
+//      serializes calls within a single Node.js process.
+//   2. Cross-process file lock: fs.openSync(lockPath, 'wx') with PID stale
+//      detection serializes across processes.
+// ---------------------------------------------------------------------------
+const BW_LOCK_FILENAME = ".ouro-bw.lock";
+const BW_COMMAND_TIMEOUT_MS = 30_000;
+const BW_LOCK_TIMEOUT_MS = 75_000;
+const BW_LOCK_POLL_MS = 100;
+const BW_LOCK_DEAD_CHILD_GRACE_MS = 2_000;
+const BW_LOCK_STALE_MS = BW_LOCK_TIMEOUT_MS * 2;
+const BW_DATA_FILENAME = "data.json";
+const BW_SYNC_MARKER_FILENAME = ".ouro-last-sync";
+const BW_SYNC_FRESH_MS = 60_000;
+const BW_TERMINAL_LOGIN_ERROR_RETRY_MS = 15 * 60_000;
+/** In-process async mutex keyed by appDataDir. */
+const inProcessLocks = new Map();
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseBwLockPidValue(content) {
+    const pid = Number.parseInt(content, 10);
+    return Number.isFinite(pid) ? pid : undefined;
+}
+function parseBwLockPid(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}
+function serializeBwLockRecord(record) {
+    return `${JSON.stringify({ ownerPid: record.ownerPid, childPid: record.childPid })}\n`;
+}
+function parseBwLockRecord(content) {
+    try {
+        const parsed = JSON.parse(content);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const record = parsed;
+            return {
+                ownerPid: parseBwLockPid(record.ownerPid),
+                childPid: parseBwLockPid(record.childPid),
+            };
+        }
+    }
+    catch {
+        // Plain-PID lock files from older runtime builds remain valid.
+    }
+    return { ownerPid: parseBwLockPidValue(content), childPid: undefined };
+}
+function getStaleBwLock(lockPath, content) {
+    const lock = parseBwLockRecord(content);
+    const ageMs = Date.now() - fs.statSync(lockPath).mtimeMs;
+    if (lock.childPid !== undefined &&
+        ageMs >= BW_LOCK_DEAD_CHILD_GRACE_MS &&
+        !isPidAlive(lock.childPid)) {
+        return { reason: "dead-child-pid", pid: lock.childPid, ownerPid: lock.ownerPid, ageMs };
+    }
+    if (lock.ownerPid !== undefined && !isPidAlive(lock.ownerPid)) {
+        return { reason: "dead-pid", pid: lock.ownerPid, ownerPid: lock.ownerPid, ageMs };
+    }
+    if (ageMs >= BW_LOCK_STALE_MS) {
+        return { reason: "stale-age", pid: lock.childPid ?? lock.ownerPid, ownerPid: lock.ownerPid, ageMs };
+    }
+    return undefined;
+}
+function reapStaleBwLock(lockPath, staleLock) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // Race with another process cleaning the same stale lock.
+        /* v8 ignore next -- race: another process may reap the same stale lock between stat and unlink @preserve */
+        return;
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        event: "repertoire.bw_lock_stale_reaped",
+        component: "repertoire",
+        message: "stale bw CLI lock reaped",
+        meta: {
+            lockPath,
+            reason: staleLock.reason,
+            pid: staleLock.pid === undefined ? "unknown" : String(staleLock.pid),
+            ownerPid: staleLock.ownerPid === undefined ? "unknown" : String(staleLock.ownerPid),
+            ageMs: String(Math.round(staleLock.ageMs)),
+        },
+    });
+}
+async function acquireFileLock(lockPath) {
+    const content = serializeBwLockRecord({ ownerPid: process.pid, childPid: undefined });
+    const deadline = Date.now() + BW_LOCK_TIMEOUT_MS;
+    while (true) {
+        try {
+            const fd = fs.openSync(lockPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL);
+            fs.writeSync(fd, content);
+            fs.closeSync(fd);
+            return {
+                recordChildPid: (pid) => {
+                    try {
+                        fs.writeFileSync(lockPath, serializeBwLockRecord({ ownerPid: process.pid, childPid: pid }));
+                    }
+                    catch {
+                        // If another process has already reaped the lock after the child
+                        // died, releasing below remains idempotent.
+                    }
+                },
+            };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST") {
+                throw err;
+            }
+            // Lock file exists -- check for stale lock
+            try {
+                const existing = fs.readFileSync(lockPath, "utf8").trim();
+                const staleLock = getStaleBwLock(lockPath, existing);
+                if (staleLock) {
+                    reapStaleBwLock(lockPath, staleLock);
+                    continue;
+                }
+            }
+            catch {
+                /* v8 ignore next -- race: lock file disappeared between openSync and readFileSync @preserve */
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`bw CLI lock timeout: could not acquire ${lockPath} within ${BW_LOCK_TIMEOUT_MS}ms`);
+            }
+            // Yield to the event loop before retrying
+            await delay(BW_LOCK_POLL_MS);
+        }
+    }
+}
+function releaseFileLock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // Already removed or never created -- safe to ignore
+    }
+}
+async function withBwLock(appDataDir, fn) {
+    if (!appDataDir) {
+        // No appDataDir means the default bw data location. Still need in-process
+        // serialization but cannot do cross-process file lock without a dir.
+        return fn();
+    }
+    const lockKey = appDataDir;
+    const lockPath = path.join(appDataDir, BW_LOCK_FILENAME);
+    // In-process serialization: chain onto the previous promise for this key
+    const previous = inProcessLocks.get(lockKey) ?? Promise.resolve();
+    let releaseLock;
+    const current = new Promise((resolve) => { releaseLock = resolve; });
+    inProcessLocks.set(lockKey, current);
+    await previous;
+    let fileLockAcquired = false;
+    let lockControl;
+    try {
+        // Cross-process file lock
+        lockControl = await acquireFileLock(lockPath);
+        fileLockAcquired = true;
+        return await fn(lockControl);
+    }
+    finally {
+        if (fileLockAcquired) {
+            releaseFileLock(lockPath);
+        }
+        releaseLock();
+        // Clean up the map entry if we are the latest
+        if (inProcessLocks.get(lockKey) === current) {
+            inProcessLocks.delete(lockKey);
+        }
+    }
+}
+function execBw(args, sessionToken, appDataDir, stdin, bwBinaryPath = "bw", extraEnv = {}) {
+    const env = {
+        ...process.env,
+        ...(sessionToken ? { BW_SESSION: sessionToken } : {}),
+        ...(appDataDir ? { BITWARDENCLI_APPDATA_DIR: appDataDir } : {}),
+        ...extraEnv,
+    };
+    const runCommand = (lock) => new Promise((resolve, reject) => {
+        const command = (0, bw_installer_1.bwCommand)(bwBinaryPath, args);
+        const child = (0, node_child_process_1.execFile)(command.file, command.args, { timeout: BW_COMMAND_TIMEOUT_MS, env }, (err, stdout, stderr) => {
+            if (err) {
+                if (isBwNotInstalled(err)) {
+                    reject(new Error("bw CLI not found. Install from https://bitwarden.com/help/cli/"));
+                    return;
+                }
+                reject(formatBwCliError(err, stderr, args));
+                return;
+            }
+            resolve(stdout);
+        });
+        if (child?.pid !== undefined) {
+            lock?.recordChildPid(child.pid);
+        }
+        if (stdin !== undefined) {
+            child?.stdin?.end(stdin);
+        }
+    });
+    return withBwLock(appDataDir, runCommand);
+}
+/** Check if the error indicates the bw CLI binary is not installed. */
+function isBwNotInstalled(err) {
+    const msg = err.message.toLowerCase();
+    const code = err.code;
+    return code === "ENOENT" || /\bspawn\b.*\benoent\b/.test(msg) || msg.includes("command not found");
+}
+/**
+ * Read the installed @bitwarden/cli version from the package that owns the
+ * resolved `bw` binary. Returns null when the binary is not an npm install.
+ */
+function readBwCliVersion(bwBinaryPath) {
+    let dir;
+    try {
+        dir = path.dirname(fs.realpathSync(bwBinaryPath));
+    }
+    catch {
+        return null;
+    }
+    for (let depth = 0; depth < 4; depth++) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+            if (pkg.name === "@bitwarden/cli" && typeof pkg.version === "string")
+                return pkg.version;
+        }
+        catch {
+            // Keep walking up toward the package root.
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/** Another process holds the profile; the profile itself is not at fault. */
+function isBwLockTimeout(err) {
+    return err.message.includes("bw CLI lock timeout");
+}
+/**
+ * A local bw step (unlock of an already-authenticated profile) failed for a
+ * reason that says nothing about the vault server: the profile on disk is
+ * unusable. Network, lock and missing-binary failures are not this, and
+ * neither is a rejected unlock secret.
+ */
+class LocalProfileUnusableError extends Error {
+    localError;
+    constructor(localError) {
+        super(localError.message);
+        this.localError = localError;
+    }
+}
+function asLocalProfileFailure(err) {
+    if (isTransientError(err) || isBwNotInstalled(err) || isBwLockTimeout(err) || isBwInvalidUnlockSecretMessage(err.message)) {
+        return err;
+    }
+    return new LocalProfileUnusableError(err);
+}
+/** A bw version as a safe directory name component. */
+function bwProfileDirName(version) {
+    return `bw-${version.replace(/[^A-Za-z0-9._-]/g, "_")}`;
+}
+/** Check if the error is transient (network/timeout) and worth retrying. */
+function isTransientError(err) {
+    const msg = err.message.toLowerCase();
+    return (msg.includes("econnrefused") ||
+        msg.includes("etimedout") ||
+        msg.includes("enotfound") ||
+        msg.includes("socket hang up") ||
+        msg.includes("econnreset") ||
+        msg.includes("eai_again") ||
+        msg.includes("enetunreach") ||
+        msg.includes("ehostunreach") ||
+        msg.includes("fetch failed") ||
+        msg.includes("429") ||
+        msg.includes("too many requests") ||
+        msg.includes("502") ||
+        msg.includes("503") ||
+        msg.includes("504") ||
+        msg.includes("bad gateway") ||
+        msg.includes("gateway timeout") ||
+        msg.includes("server unavailable") ||
+        msg.includes("timed out"));
+}
+const MAX_RETRIES = 3;
+const BASE_BACKOFF_MS = 1000;
+const TRANSIENT_MAX_RETRIES = 3;
+const TRANSIENT_RETRY_BASE_MS = 500;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isBwLoginItem(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const item = value;
+    if (typeof item.id !== "string" || item.id.trim().length === 0)
+        return false;
+    if (typeof item.name !== "string" || item.name.trim().length === 0)
+        return false;
+    if (item.login !== undefined) {
+        if (!item.login || typeof item.login !== "object" || Array.isArray(item.login))
+            return false;
+        const login = item.login;
+        if (login.username !== undefined && typeof login.username !== "string")
+            return false;
+        if (login.password !== undefined && typeof login.password !== "string")
+            return false;
+        if (login.uris !== undefined) {
+            if (!Array.isArray(login.uris))
+                return false;
+            for (const uri of login.uris) {
+                if (!uri || typeof uri !== "object" || Array.isArray(uri))
+                    return false;
+                const uriRecord = uri;
+                if (uriRecord.uri !== undefined && typeof uriRecord.uri !== "string")
+                    return false;
+            }
+        }
+    }
+    if (item.notes !== undefined && item.notes !== null && typeof item.notes !== "string")
+        return false;
+    if (item.revisionDate !== undefined && typeof item.revisionDate !== "string")
+        return false;
+    return true;
+}
+function parseBwItemArray(stdout, context) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+        if (!Array.isArray(parsed)) {
+            throw new Error("expected item array");
+        }
+    }
+    catch {
+        throw new Error(`bw CLI error: invalid JSON from ${context}`);
+    }
+    return parsed;
+}
+function parseBwItems(stdout, context) {
+    const items = parseBwItemArray(stdout, context);
+    if (!items.every(isBwLoginItem)) {
+        throw new Error(`bw CLI error: invalid item from ${context}`);
+    }
+    return items;
+}
+function parseStructuredBwItems(stdout, context) {
+    const rawItems = parseBwItemArray(stdout, context);
+    const items = new Map();
+    const malformedNames = new Set();
+    for (const rawItem of rawItems) {
+        if (!rawItem || typeof rawItem !== "object" || Array.isArray(rawItem))
+            continue;
+        const name = rawItem.name;
+        if (typeof name !== "string" || name.trim().length === 0)
+            continue;
+        if (isBwLoginItem(rawItem)) {
+            items.set(name, rawItem);
+        }
+        else {
+            malformedNames.add(name);
+        }
+    }
+    return { items, malformedNames };
+}
+function parseBwItem(stdout, context) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+        if (!isBwLoginItem(parsed)) {
+            throw new Error("expected login item");
+        }
+        return parsed;
+    }
+    catch {
+        if (parsed !== undefined) {
+            throw new Error(`bw CLI error: invalid item from ${context}`);
+        }
+        throw new Error(`bw CLI error: invalid JSON from ${context}`);
+    }
+}
+function parseBwItemId(stdout) {
+    try {
+        const parsed = JSON.parse(stdout);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const id = parsed.id;
+        return typeof id === "string" && id.trim().length > 0 ? id : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// BitwardenCredentialStore
+// ---------------------------------------------------------------------------
+class BitwardenCredentialStore {
+    serverUrl;
+    email;
+    masterPassword;
+    /** The agent's bw folder; each bw version keeps its own profile under it. */
+    agentDataDir;
+    /** The profile directory for the running bw version (BITWARDENCLI_APPDATA_DIR). */
+    appDataDir;
+    onInvalidUnlockSecret;
+    onLoginSuccess;
+    onProgress;
+    sessionToken = null;
+    terminalLoginError = null;
+    terminalLoginErrorAt = 0;
+    bwBinaryPath = "bw";
+    structuredItemCache = null;
+    constructor(serverUrl, email, masterPassword, options = {}) {
+        this.serverUrl = serverUrl;
+        this.email = email;
+        this.masterPassword = masterPassword;
+        this.agentDataDir = options.appDataDir;
+        this.appDataDir = options.appDataDir;
+        this.onInvalidUnlockSecret = options.onInvalidUnlockSecret;
+        this.onLoginSuccess = options.onLoginSuccess;
+        this.onProgress = options.onProgress;
+    }
+    isReady() {
+        return true;
+    }
+    execBw(args, sessionToken, stdin) {
+        return execBw(args, sessionToken, this.appDataDir, stdin, this.bwBinaryPath);
+    }
+    execBwWithPasswordEnv(args) {
+        return execBw([...args, "--passwordenv", BW_PASSWORD_ENV], undefined, this.appDataDir, undefined, this.bwBinaryPath, { [BW_PASSWORD_ENV]: this.masterPassword });
+    }
+    async notifyInvalidUnlockSecret(error) {
+        if (!this.onInvalidUnlockSecret)
+            return;
+        try {
+            await this.onInvalidUnlockSecret(error);
+        }
+        catch (callbackError) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                event: "repertoire.bw_invalid_unlock_cleanup_failed",
+                component: "repertoire",
+                message: "failed to clean up rejected local vault unlock material",
+                meta: {
+                    email: this.email,
+                    serverUrl: this.serverUrl,
+                    error: callbackError instanceof Error ? callbackError.message : String(callbackError),
+                    originalError: error.message,
+                },
+            });
+        }
+    }
+    /**
+     * Ensure the bw CLI is authenticated and unlocked.
+     * Handles three states: logged out → login, locked → unlock, already unlocked → no-op.
+     * Retries transient failures (network/timeout) up to MAX_RETRIES with exponential backoff.
+     */
+    async login() {
+        if (this.terminalLoginError) {
+            // A long-lived process retries a terminal failure after a while instead
+            // of holding it until restart; rejected secrets are paused separately.
+            if (Date.now() - this.terminalLoginErrorAt < BW_TERMINAL_LOGIN_ERROR_RETRY_MS) {
+                throw this.terminalLoginError;
+            }
+            this.terminalLoginError = null;
+        }
+        // Ensure bw CLI is installed before any bw commands
+        this.onProgress?.("finding the Bitwarden CLI");
+        this.bwBinaryPath = await (0, bw_installer_1.ensureBwCli)();
+        const bwVersion = readBwCliVersion(this.bwBinaryPath);
+        this.onProgress?.(`using bw ${bwVersion ?? "(unknown version)"} at ${this.bwBinaryPath}`);
+        if (this.agentDataDir) {
+            // Each bw version gets its own profile directory, so machines with
+            // several bw installs (one per Node version) never migrate or fight
+            // over one another's state.
+            this.appDataDir = bwVersion ? path.join(this.agentDataDir, bwProfileDirName(bwVersion)) : this.agentDataDir;
+            fs.mkdirSync(this.appDataDir, { recursive: true, mode: 0o700 });
+        }
+        let lastError;
+        for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+            try {
+                await this.loginAttempt();
+                await this.onLoginSuccess?.();
+                return;
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: loginAttempt always throws Error instances @preserve */
+                lastError = err instanceof Error ? err : new Error(String(err));
+                // Don't retry non-transient errors (auth failures, bw not installed)
+                if (!isTransientError(lastError)) {
+                    this.setTerminalLoginError(lastError);
+                    if (isBwInvalidUnlockSecretMessage(lastError.message)) {
+                        await this.notifyInvalidUnlockSecret(lastError);
+                    }
+                    throw lastError;
+                }
+                // Don't retry after final attempt
+                if (attempt === MAX_RETRIES - 1)
+                    break;
+                const backoffMs = BASE_BACKOFF_MS * Math.pow(2, attempt);
+                (0, runtime_1.emitNervesEvent)({
+                    event: "repertoire.bw_login_retry",
+                    component: "repertoire",
+                    message: `bw login attempt ${attempt + 1} failed, retrying in ${backoffMs}ms`,
+                    meta: { attempt: attempt + 1, backoffMs, reason: lastError.message },
+                });
+                this.onProgress?.(`sign-in attempt ${attempt + 1} failed (${lastError.message.split("\n")[0].slice(0, 120)}); retrying in ${Math.round(backoffMs / 1000)}s`);
+                await delay(backoffMs);
+            }
+        }
+        this.setTerminalLoginError(lastError);
+        /* v8 ignore next -- invalid unlock errors are non-transient and exit through the non-retry path above @preserve */
+        if (isBwInvalidUnlockSecretMessage(lastError.message)) {
+            await this.notifyInvalidUnlockSecret(lastError);
+        }
+        throw lastError;
+    }
+    setTerminalLoginError(error) {
+        this.terminalLoginError = error;
+        this.terminalLoginErrorAt = Date.now();
+    }
+    /**
+     * Single login attempt — called by login() retry loop.
+     *
+     * The bw profile directory is a disposable cache; the durable secret is the
+     * machine's vault unlock material. When a local step fails on an
+     * authenticated profile (a corrupt or half-migrated profile, a missing
+     * session), the profile is moved aside and rebuilt with one fresh login.
+     * Server steps (login, sync), network failures, lock contention and
+     * rejected secrets never discard the profile, so a bad secret or a flaky
+     * server costs at most one server login per attempt.
+     */
+    async loginAttempt() {
+        try {
+            await this.loginWithLocalProfile();
+        }
+        catch (error) {
+            if (!(error instanceof LocalProfileUnusableError))
+                throw error;
+            await this.discardLocalProfile(error.localError);
+            try {
+                await this.loginWithLocalProfile();
+            }
+            catch (retryError) {
+                throw retryError instanceof LocalProfileUnusableError ? retryError.localError : retryError;
+            }
+        }
+    }
+    /**
+     * Move the local bw profile aside so the next bw command starts from an
+     * empty profile. The previous data file is kept as one `.discarded` copy
+     * for diagnosis and is overwritten by the next discard.
+     */
+    async discardLocalProfile(cause) {
+        const appDataDir = this.appDataDir;
+        this.sessionToken = null;
+        this.structuredItemCache = null;
+        await withBwLock(appDataDir, async () => {
+            const dataPath = path.join(appDataDir, BW_DATA_FILENAME);
+            try {
+                fs.renameSync(dataPath, `${dataPath}.discarded`);
+            }
+            catch {
+                // Already gone: another process discarded it first, which is the same outcome.
+            }
+            fs.rmSync(path.join(appDataDir, BW_SYNC_MARKER_FILENAME), { force: true });
+        });
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_local_profile_discarded",
+            component: "repertoire",
+            message: "discarded unusable local bw profile; logging in fresh with the saved unlock secret",
+            meta: {
+                email: this.email,
+                serverUrl: this.serverUrl,
+                error: sanitizeCredentialErrorDetail(cause.message),
+            },
+        });
+    }
+    async loginWithLocalProfile() {
+        this.onProgress?.("reading the local bw profile");
+        let status = await this.readStatus();
+        if (this.shouldRebuildLocalProfile(status)) {
+            await this.rebuildLocalProfile("local bw profile did not match requested vault", status);
+            status = { status: "unlocked", serverUrl: this.serverUrl, userEmail: this.email };
+        }
+        // Configure server URL if needed (only works when logged out)
+        if (status.status === "unauthenticated" || !status.serverUrl) {
+            try {
+                this.onProgress?.(`pointing bw at ${this.serverUrl}`);
+                await this.execBw(["config", "server", this.serverUrl]);
+            }
+            catch (error) {
+                const err = error;
+                if (!isBwConfigLogoutRequired(err))
+                    throw err;
+                // "Logout required" means bw already has local auth state; keep the
+                // existing behavior and proceed to login/unlock below.
+            }
+        }
+        if (!this.sessionToken) {
+            this.onProgress?.(status.status === "unauthenticated" || !status.status ? `signing in to ${this.serverUrl} as ${this.email}` : `unlocking ${this.email}`);
+            if (status.status === "locked") {
+                // Already logged in, just needs unlock.
+                const unlockOutput = await this.execWithLocalProfileRebuild("unlock rejected saved local unlock material", status, () => this.execBwWithPasswordEnv(["unlock", "--raw"]));
+                this.sessionToken = unlockOutput.trim();
+            }
+            else if (status.status === "unauthenticated" || !status.status) {
+                // Not logged in -- full login.
+                this.sessionToken = this.sessionTokenFromLoginOutput(await this.loginWithPassword());
+            }
+            else {
+                // Status is "unlocked" -- already good, just need the session token.
+                const unlockOutput = await this.execWithLocalProfileRebuild("unlocked bw profile rejected saved local unlock material", status, () => this.execBwWithPasswordEnv(["unlock", "--raw"]));
+                this.sessionToken = unlockOutput.trim();
+            }
+        }
+        if (this.shouldSyncVaultAfterSession(status)) {
+            this.onProgress?.("syncing vault items");
+            /* v8 ignore next -- defensive: loginAttempt always sets sessionToken before sync @preserve */
+            await this.execBw(["sync"], this.sessionToken ?? undefined);
+            this.writeSyncMarker();
+        }
+        else {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_sync_skipped",
+                component: "repertoire",
+                message: "skipping bw sync because local vault cache is still fresh",
+                meta: { email: this.email, serverUrl: this.serverUrl, freshnessWindowMs: BW_SYNC_FRESH_MS },
+            });
+        }
+        this.terminalLoginError = null;
+    }
+    async readStatus() {
+        try {
+            const raw = await this.execBw(["status"]);
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return {};
+            const record = parsed;
+            return {
+                ...(typeof record.status === "string" ? { status: record.status } : {}),
+                ...(typeof record.serverUrl === "string" ? { serverUrl: record.serverUrl } : {}),
+                ...(typeof record.userEmail === "string" ? { userEmail: record.userEmail } : {}),
+            };
+        }
+        catch (err) {
+            // If bw CLI is not installed or a transient error, propagate it for retry.
+            if (err instanceof Error && (isBwNotInstalled(err) || isTransientError(err))) {
+                throw err;
+            }
+            // CLI not configured or broken -- proceed with full setup.
+            return {};
+        }
+    }
+    normalizedServerUrl(value) {
+        return value.trim().replace(/\/+$/, "").toLowerCase();
+    }
+    shouldRebuildLocalProfile(status) {
+        if (status.status !== "locked" && status.status !== "unlocked")
+            return false;
+        if (status.serverUrl && this.normalizedServerUrl(status.serverUrl) !== this.normalizedServerUrl(this.serverUrl))
+            return true;
+        if (status.userEmail && status.userEmail.trim().toLowerCase() !== this.email.trim().toLowerCase())
+            return true;
+        return false;
+    }
+    sessionTokenFromLoginOutput(loginOutput) {
+        try {
+            const parsed = JSON.parse(loginOutput);
+            return typeof parsed.access_token === "string" && parsed.access_token.trim()
+                ? parsed.access_token.trim()
+                : loginOutput.trim();
+        }
+        catch {
+            return loginOutput.trim();
+        }
+    }
+    async loginWithPassword() {
+        try {
+            return await this.execBwWithPasswordEnv(["login", this.email, "--raw"]);
+        }
+        catch (error) {
+            const err = error;
+            if (!isBwAlreadyLoggedInError(err))
+                throw err;
+        }
+        try {
+            return await this.execBwWithPasswordEnv(["unlock", "--raw"]);
+        }
+        catch (error) {
+            throw asLocalProfileFailure(error);
+        }
+    }
+    forgetLocalSyncMarker() {
+        if (!this.appDataDir)
+            return;
+        try {
+            fs.rmSync(path.join(this.appDataDir, BW_SYNC_MARKER_FILENAME), { force: true });
+        }
+        catch {
+            // A stale sync marker is only a cache hint; failure to remove it should not block auth repair.
+        }
+    }
+    async logoutLocalProfile(reason, status, cause) {
+        this.sessionToken = null;
+        this.structuredItemCache = null;
+        this.forgetLocalSyncMarker();
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            event: "repertoire.bw_local_profile_rebuild",
+            component: "repertoire",
+            message: "rebuilding local bw profile for agent vault",
+            meta: {
+                email: this.email,
+                serverUrl: this.serverUrl,
+                reason,
+                /* v8 ignore next -- defensive: every profile rebuild path starts from a locked/unlocked bw status @preserve */
+                previousStatus: status.status ?? "unknown",
+                previousServerUrl: status.serverUrl ?? null,
+                previousUserEmail: status.userEmail ?? null,
+                /* v8 ignore next -- defensive: internal rebuild callers pass Error or undefined causes @preserve */
+                error: cause instanceof Error ? cause.message : cause ? String(cause) : undefined,
+            },
+        });
+        try {
+            await this.execBw(["logout"]);
+        }
+        catch (error) {
+            const err = error;
+            if (isBwLoggedOutOrUnauthenticatedError(err))
+                return;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                event: "repertoire.bw_local_profile_logout_failed",
+                component: "repertoire",
+                message: "failed to logout local bw profile before rebuild",
+                meta: { email: this.email, serverUrl: this.serverUrl, error: err.message },
+            });
+        }
+    }
+    async rebuildLocalProfile(reason, status, cause) {
+        await this.logoutLocalProfile(reason, status, cause);
+        await this.execBw(["config", "server", this.serverUrl]);
+        this.sessionToken = this.sessionTokenFromLoginOutput(await this.loginWithPassword());
+    }
+    async execWithLocalProfileRebuild(reason, status, operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            const err = error;
+            if (!isBwInvalidUnlockSecretMessage(err.message))
+                throw asLocalProfileFailure(err);
+            await this.rebuildLocalProfile(reason, status, err);
+            /* v8 ignore next -- defensive: rebuildLocalProfile always stores a string session token on success @preserve */
+            return this.sessionToken ?? "";
+        }
+    }
+    async ensureSession() {
+        if (!this.sessionToken) {
+            await this.login();
+        }
+        /* v8 ignore next -- defensive: login() always sets sessionToken on success @preserve */
+        return this.sessionToken ?? undefined;
+    }
+    async withSessionRetry(operation) {
+        let attemptedFreshSession = false;
+        while (true) {
+            const session = await this.ensureSession();
+            try {
+                return await operation(session);
+            }
+            catch (error) {
+                const err = error;
+                if (attemptedFreshSession || !isBwSessionAuthError(err)) {
+                    throw err;
+                }
+                this.sessionToken = null;
+                this.structuredItemCache = null;
+                attemptedFreshSession = true;
+            }
+        }
+    }
+    async withTransientRetry(operation) {
+        let lastError;
+        for (let attempt = 0; attempt < TRANSIENT_MAX_RETRIES; attempt++) {
+            try {
+                return await operation();
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: operation always throws Error instances @preserve */
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (!isTransientError(lastError)) {
+                    throw lastError;
+                }
+                if (attempt === TRANSIENT_MAX_RETRIES - 1)
+                    break;
+                const backoffMs = TRANSIENT_RETRY_BASE_MS * Math.pow(2, attempt);
+                (0, runtime_1.emitNervesEvent)({
+                    event: "repertoire.bw_transient_retry",
+                    component: "repertoire",
+                    message: `transient bw error, retrying in ${backoffMs}ms`,
+                    meta: { attempt: attempt + 1, backoffMs, reason: lastError.message },
+                });
+                await delay(backoffMs);
+            }
+        }
+        throw lastError;
+    }
+    async get(domain) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_get_start",
+            component: "repertoire",
+            message: `getting credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        const item = await this.withTransientRetry(() => this.withSessionRetry((session) => this.findItemByDomain(domain, session)));
+        if (!item) {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_get_end",
+                component: "repertoire",
+                message: `no bw credential for ${domain}`,
+                meta: { domain, found: false, backend: "bitwarden" },
+            });
+            return null;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_get_end",
+            component: "repertoire",
+            message: `bw credential found for ${domain}`,
+            meta: { domain, found: true, backend: "bitwarden" },
+        });
+        return {
+            domain: item.name,
+            username: item.login?.username,
+            notes: item.notes ?? undefined,
+            createdAt: item.revisionDate ?? new Date().toISOString(),
+        };
+    }
+    async getRawSecret(domain, field) {
+        const item = await this.withTransientRetry(() => this.withSessionRetry((session) => this.findItemByDomain(domain, session)));
+        if (!item) {
+            throw new Error(`no credential found for domain "${domain}"`);
+        }
+        // Map common field names to bw item structure
+        let value;
+        if (field === "password") {
+            value = item.login?.password;
+        }
+        else if (field === "username") {
+            value = item.login?.username;
+        }
+        else {
+            value = item[field];
+        }
+        if (value === undefined || value === null) {
+            throw new Error(`field "${field}" not found for domain "${domain}"`);
+        }
+        return String(value);
+    }
+    async store(domain, data) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_store_start",
+            component: "repertoire",
+            message: `storing credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        await this.withSessionRetry(async (session) => {
+            if (shouldUseStructuredItemLookup(domain)) {
+                this.structuredItemCache = null;
+            }
+            const existing = await this.findItemByDomain(domain, session);
+            const item = {
+                ...(existing ?? {}),
+                type: 1, // Login type
+                name: domain,
+                login: {
+                    username: data.username ?? "",
+                    password: data.password,
+                    uris: [{ uri: `https://${domain}` }],
+                },
+                notes: data.notes ?? null,
+            };
+            const encoded = Buffer.from(JSON.stringify(item)).toString("base64");
+            this.structuredItemCache = null;
+            let savedItem;
+            if (existing) {
+                const stdout = await this.execBw(["edit", "item", existing.id], session, encoded);
+                const savedItemId = parseBwItemId(stdout) ?? existing.id;
+                savedItem = await this.findItemById(savedItemId, session);
+            }
+            else {
+                const stdout = await this.execBw(["create", "item"], session, encoded);
+                const savedItemId = parseBwItemId(stdout);
+                savedItem = savedItemId
+                    ? await this.findItemById(savedItemId, session)
+                    : await this.findItemByDomain(domain, session);
+            }
+            this.assertStoredCredentialMatches(domain, data, savedItem);
+        });
+        this.structuredItemCache = null;
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_store_end",
+            component: "repertoire",
+            message: `credential stored via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+    }
+    async list() {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_list_start",
+            component: "repertoire",
+            message: "listing bw credentials",
+            meta: { backend: "bitwarden" },
+        });
+        const stdout = await this.withTransientRetry(() => this.withSessionRetry((session) => this.execBw(["list", "items"], session)));
+        const items = parseBwItems(stdout, "bw list items");
+        const results = items.map((item) => ({
+            domain: item.name,
+            username: item.login?.username,
+            notes: item.notes ?? undefined,
+            createdAt: item.revisionDate ?? new Date().toISOString(),
+        }));
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_list_end",
+            component: "repertoire",
+            message: "bw credentials listed",
+            meta: { backend: "bitwarden", count: results.length },
+        });
+        return results;
+    }
+    async delete(domain) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_delete_start",
+            component: "repertoire",
+            message: `deleting credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        const item = await this.withSessionRetry((session) => this.findItemByDomain(domain, session));
+        if (!item) {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_delete_end",
+                component: "repertoire",
+                message: `no bw credential to delete for ${domain}`,
+                meta: { domain, deleted: false, backend: "bitwarden" },
+            });
+            return false;
+        }
+        await this.withSessionRetry((session) => this.execBw(["delete", "item", item.id], session));
+        this.structuredItemCache = null;
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_delete_end",
+            component: "repertoire",
+            message: `credential deleted via bw for ${domain}`,
+            meta: { domain, deleted: true, backend: "bitwarden" },
+        });
+        return true;
+    }
+    // --- Private ---
+    async findItemByDomain(domain, session) {
+        if (shouldUseStructuredItemLookup(domain)) {
+            const cache = await this.readStructuredItemCache(session);
+            if (cache.malformedNames.has(domain)) {
+                throw new Error("bw CLI error: invalid item from bw list items");
+            }
+            const item = cache.items.get(domain);
+            if (item)
+                return item;
+            return null;
+        }
+        const stdout = await this.execBw(["list", "items", "--search", domain], session);
+        const items = parseBwItems(stdout, "bw list items --search");
+        // Find exact match by name
+        return items.find((item) => item.name === domain) ?? null;
+    }
+    shouldSyncVaultAfterSession(status) {
+        if (status.status === "unauthenticated" || !status.status)
+            return true;
+        if (!this.appDataDir)
+            return true;
+        const freshnessTimestamp = this.latestLocalSyncTimestamp();
+        if (freshnessTimestamp !== null) {
+            return Date.now() - freshnessTimestamp > BW_SYNC_FRESH_MS;
+        }
+        return true;
+    }
+    latestLocalSyncTimestamp() {
+        const files = [BW_SYNC_MARKER_FILENAME, BW_DATA_FILENAME];
+        let latest = null;
+        for (const name of files) {
+            try {
+                const mtimeMs = fs.statSync(path.join(this.appDataDir, name)).mtimeMs;
+                latest = latest === null ? mtimeMs : Math.max(latest, mtimeMs);
+            }
+            catch {
+                // Missing freshness file is fine; use any other available timestamp.
+            }
+        }
+        return latest;
+    }
+    writeSyncMarker() {
+        if (!this.appDataDir)
+            return;
+        try {
+            fs.writeFileSync(path.join(this.appDataDir, BW_SYNC_MARKER_FILENAME), `${Date.now()}\n`, { mode: 0o600 });
+        }
+        catch {
+            // If the marker cannot be written, fall back to syncing next time.
+        }
+    }
+    async findItemById(id, session) {
+        const stdout = await this.execBw(["get", "item", id], session);
+        return parseBwItem(stdout, "bw get item");
+    }
+    async readStructuredItemCache(session) {
+        if (this.structuredItemCache)
+            return this.structuredItemCache;
+        const stdout = await this.execBw(["list", "items"], session);
+        this.structuredItemCache = parseStructuredBwItems(stdout, "bw list items");
+        return this.structuredItemCache;
+    }
+    assertStoredCredentialMatches(domain, data, item) {
+        if (!item) {
+            throw new Error(`bw CLI error: credential save verification failed for ${domain}: saved item could not be read back after write`);
+        }
+        const mismatches = [];
+        if (item.name !== domain)
+            mismatches.push("name");
+        if ((item.login?.username ?? "") !== (data.username ?? ""))
+            mismatches.push("username");
+        if ((item.login?.password ?? "") !== data.password)
+            mismatches.push("password");
+        if ((item.notes ?? null) !== (data.notes ?? null))
+            mismatches.push("notes");
+        if (mismatches.length > 0) {
+            const label = mismatches.length === 1 ? "field" : "fields";
+            throw new Error(`bw CLI error: credential save verification failed for ${domain}: saved item did not match requested ${label} ${mismatches.join(", ")}`);
+        }
+    }
+}
+exports.BitwardenCredentialStore = BitwardenCredentialStore;