aquaman-proxy 0.7.1 → 0.9.0

package/README.md

@@ -44,7 +44,7 @@ openclaw                                  # proxy starts automatically via plugi
 > `aquaman setup` auto-detects your credential backend. macOS defaults to Keychain,
 > Linux defaults to encrypted file. Override with `--backend`:
 > `aquaman setup --backend keepassxc`
-> Options: `keychain`, `encrypted-file`, `keepassxc`, `1password`, `vault`
+> Options: `keychain`, `encrypted-file`, `keepassxc`, `1password`, `vault`, `systemd-creds`, `bitwarden`
 
 Existing plaintext credentials are migrated automatically during setup.
 Run again anytime to migrate new credentials: `aquaman migrate openclaw --auto`

package/dist/cli/index.js

@@ -147,7 +147,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -157,7 +157,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -297,7 +300,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -307,7 +310,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -365,7 +371,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -375,7 +381,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -487,7 +496,7 @@ program
 program
     .command('setup')
     .description('All-in-one setup wizard — creates config, stores credentials, installs plugin')
-    .option('--backend <backend>', 'Credential backend (keychain, encrypted-file, keepassxc, 1password, vault)')
+    .option('--backend <backend>', 'Credential backend (keychain, encrypted-file, keepassxc, 1password, vault, systemd-creds, bitwarden)')
     .option('--no-openclaw', 'Skip OpenClaw plugin installation')
     .option('--non-interactive', 'Use environment variables instead of prompts (for CI)')
     .action(async (options) => {
@@ -520,19 +529,20 @@ program
             backend = 'keychain';
         }
         else {
-            // Linux: check for libsecret
+            // Linux: check for libsecret first, then systemd-creds, then encrypted-file
             try {
                 const { execSync } = await import('node:child_process');
                 execSync('pkg-config --exists libsecret-1', { stdio: 'pipe' });
                 backend = 'keychain';
             }
             catch {
-                backend = 'encrypted-file';
+                const { isSystemdCredsAvailable } = await import('../core/credentials/backends/systemd-creds.js');
+                backend = isSystemdCredsAvailable() ? 'systemd-creds' : 'encrypted-file';
             }
         }
     }
     // Validate backend
-    const validBackends = ['keychain', 'encrypted-file', 'keepassxc', '1password', 'vault'];
+    const validBackends = ['keychain', 'encrypted-file', 'keepassxc', '1password', 'vault', 'systemd-creds', 'bitwarden'];
     if (!validBackends.includes(backend)) {
         console.error(`  Invalid backend: ${backend}`);
         console.error(`  Valid options: ${validBackends.join(', ')}`);
@@ -605,6 +615,51 @@ program
             }
         }
     }
+    else if (backend === 'systemd-creds') {
+        const { isSystemdCredsAvailable } = await import('../core/credentials/backends/systemd-creds.js');
+        if (!isSystemdCredsAvailable()) {
+            console.error('  systemd-creds backend requires systemd-creds with --user support (systemd >= 256).');
+            console.error('  Try: systemd-creds --version');
+            process.exit(1);
+        }
+    }
+    else if (backend === 'bitwarden') {
+        try {
+            const { execSync } = await import('node:child_process');
+            execSync('which bw', { stdio: 'pipe' });
+            // Check status
+            const statusJson = execSync('bw status', { stdio: 'pipe', encoding: 'utf-8' });
+            const status = JSON.parse(statusJson);
+            if (status.status === 'unauthenticated') {
+                console.error('  Bitwarden CLI is installed but not logged in.');
+                console.error('  Run: bw login');
+                process.exit(1);
+            }
+            if (status.status === 'locked') {
+                const session = process.env['BW_SESSION'];
+                if (!session) {
+                    console.error('  Bitwarden vault is locked.');
+                    console.error('  Run: export BW_SESSION=$(bw unlock --raw)');
+                    process.exit(1);
+                }
+                // Verify session works
+                try {
+                    execSync('bw sync', { stdio: 'pipe', env: { ...process.env, BW_SESSION: session } });
+                }
+                catch {
+                    console.error('  BW_SESSION is invalid or expired.');
+                    console.error('  Run: export BW_SESSION=$(bw unlock --raw)');
+                    process.exit(1);
+                }
+            }
+        }
+        catch {
+            console.error('  Bitwarden CLI not found.');
+            console.error('  Install: https://bitwarden.com/help/cli/');
+            console.error('  Then: bw login && export BW_SESSION=$(bw unlock --raw)');
+            process.exit(1);
+        }
+    }
     // 2. Run init internally (create dirs, config)
     ensureConfigDir();
     const config = getDefaultConfig();
@@ -616,7 +671,7 @@ program
     // 3. Prompt for API keys (or read from env in non-interactive mode)
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
             vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
@@ -624,7 +679,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -883,7 +941,22 @@ program
     let store = null;
     try {
         config = loadConfig();
-        store = createCredentialStore({
+        if (config.credentials.backend === 'systemd-creds') {
+            const { isSystemdCredsAvailable } = await import('../core/credentials/backends/systemd-creds.js');
+            if (!isSystemdCredsAvailable()) {
+                throw new Error('systemd-creds backend requires systemd >= 256 with --user support');
+            }
+        }
+        if (config.credentials.backend === 'bitwarden') {
+            const { BitwardenStore } = await import('../core/credentials/backends/bitwarden.js');
+            if (!BitwardenStore.isAvailable()) {
+                throw new Error('Bitwarden CLI (bw) not found. Install: https://bitwarden.com/help/cli/');
+            }
+            if (!BitwardenStore.isUnlocked()) {
+                throw new Error('Bitwarden vault is locked. Run: export BW_SESSION=$(bw unlock --raw)');
+            }
+        }
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -891,7 +964,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
         // 3. Count credentials
         const creds = await store.list();
@@ -1251,7 +1327,7 @@ credentials
     const backend = options.backend || config.credentials.backend;
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1261,7 +1337,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (error) {
@@ -1307,7 +1386,7 @@ credentials
     const config = loadConfig();
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1315,7 +1394,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch {
@@ -1339,7 +1421,7 @@ credentials
     const config = loadConfig();
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1347,7 +1429,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch {
@@ -1365,7 +1450,7 @@ credentials
 credentials
     .command('guide')
     .description('Show setup commands for seeding credentials based on your backend')
-    .option('--backend <backend>', 'Override backend (keychain, encrypted-file, vault, 1password)')
+    .option('--backend <backend>', 'Override backend (keychain, encrypted-file, vault, 1password, bitwarden)')
     .option('--service <name>', 'Show commands for a single service only')
     .action(async (options) => {
     const config = loadConfig();
@@ -1686,7 +1771,7 @@ migrate
         // Migrate
         let store;
         try {
-            store = createCredentialStore({
+            store = await createCredentialStore({
                 backend: appConfig.credentials.backend,
                 encryptionPassword: appConfig.credentials.encryptionPassword,
                 vaultAddress: appConfig.credentials.vaultAddress,
@@ -1840,7 +1925,7 @@ migrate
     if (opts.dryRun) {
         console.log('(dry run - no credentials will be written)\n');
     }
-    const store = createCredentialStore({
+    const store = await createCredentialStore({
         backend: appConfig.credentials.backend,
         encryptionPassword: appConfig.credentials.encryptionPassword,
         vaultAddress: appConfig.credentials.vaultAddress,
@@ -1896,7 +1981,7 @@ program
     }
     // Check for stored credentials
     try {
-        const store = createCredentialStore({
+        const store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1904,7 +1989,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
         const creds = await store.list();
         console.log(`\nStored credentials: ${creds.length}`);