aquaman-proxy 0.8.0 → 0.9.1

package/README.md

@@ -25,11 +25,12 @@ Agent / OpenClaw Gateway              Aquaman Proxy
                                          │  (hash-chained log)
                                          ▼
                                api.anthropic.com
+                               api.mistral.ai
                                api.telegram.org
                                slack.com/api  ...
 ```
 
-This package is the right side. A reverse proxy that listens on a Unix domain socket (`~/.aquaman/proxy.sock`) and injects credentials from secure backends. No TCP port, no network exposure. 23 builtin services, four auth modes.
+This package is the right side. A reverse proxy that listens on a Unix domain socket (`~/.aquaman/proxy.sock`) and injects credentials from secure backends. No TCP port, no network exposure. 25 builtin services, six auth modes.
 
 ## Quick Start
 
@@ -44,7 +45,7 @@ openclaw                                  # proxy starts automatically via plugi
 > `aquaman setup` auto-detects your credential backend. macOS defaults to Keychain,
 > Linux defaults to encrypted file. Override with `--backend`:
 > `aquaman setup --backend keepassxc`
-> Options: `keychain`, `encrypted-file`, `keepassxc`, `1password`, `vault`, `systemd-creds`
+> Options: `keychain`, `encrypted-file`, `keepassxc`, `1password`, `vault`, `systemd-creds`, `bitwarden`
 
 Existing plaintext credentials are migrated automatically during setup.
 Run again anytime to migrate new credentials: `aquaman migrate openclaw --auto`
@@ -76,15 +77,15 @@ Troubleshooting: `aquaman doctor`
 | `aquaman audit tail` | Recent audit entries |
 | `aquaman audit verify` | Verify hash chain integrity |
 
-## 23 Builtin Services
+## 25 Builtin Services
 
 | Category | Services |
 |----------|----------|
-| **LLM / AI** | Anthropic, OpenAI, GitHub, xAI, Cloudflare AI Gateway |
-| **Header** | Slack, Discord, Matrix, Mattermost, LINE, Twitch, Telnyx, ElevenLabs, Zalo |
-| **URL-path** | Telegram |
-| **HTTP Basic** | Twilio, BlueBubbles, Nextcloud Talk |
-| **OAuth** | MS Teams, Feishu, Google Chat |
+| **Providers** | Anthropic, OpenAI, GitHub, xAI, Cloudflare AI Gateway, Mistral, Hugging Face, ElevenLabs |
+| **Channels (header)** | Slack, Discord, Matrix, Mattermost, LINE, Twitch, Telnyx, Zalo |
+| **Channels (URL-path)** | Telegram |
+| **Channels (basic)** | Twilio, BlueBubbles, Nextcloud Talk |
+| **Channels (OAuth)** | MS Teams, Feishu, Google Chat |
 | **At-rest only** | Nostr, Tlon |
 
 ## Documentation

package/dist/cli/index.js

@@ -147,7 +147,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -157,7 +157,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -297,7 +300,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -307,7 +310,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -365,7 +371,7 @@ program
     // Initialize credential store
     let credentialStore;
     try {
-        credentialStore = createCredentialStore({
+        credentialStore = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -375,7 +381,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -487,7 +496,7 @@ program
 program
     .command('setup')
     .description('All-in-one setup wizard — creates config, stores credentials, installs plugin')
-    .option('--backend <backend>', 'Credential backend (keychain, encrypted-file, keepassxc, 1password, vault, systemd-creds)')
+    .option('--backend <backend>', 'Credential backend (keychain, encrypted-file, keepassxc, 1password, vault, systemd-creds, bitwarden)')
     .option('--no-openclaw', 'Skip OpenClaw plugin installation')
     .option('--non-interactive', 'Use environment variables instead of prompts (for CI)')
     .action(async (options) => {
@@ -533,7 +542,7 @@ program
         }
     }
     // Validate backend
-    const validBackends = ['keychain', 'encrypted-file', 'keepassxc', '1password', 'vault', 'systemd-creds'];
+    const validBackends = ['keychain', 'encrypted-file', 'keepassxc', '1password', 'vault', 'systemd-creds', 'bitwarden'];
     if (!validBackends.includes(backend)) {
         console.error(`  Invalid backend: ${backend}`);
         console.error(`  Valid options: ${validBackends.join(', ')}`);
@@ -614,6 +623,43 @@ program
             process.exit(1);
         }
     }
+    else if (backend === 'bitwarden') {
+        try {
+            const { execSync } = await import('node:child_process');
+            execSync('which bw', { stdio: 'pipe' });
+            // Check status
+            const statusJson = execSync('bw status', { stdio: 'pipe', encoding: 'utf-8' });
+            const status = JSON.parse(statusJson);
+            if (status.status === 'unauthenticated') {
+                console.error('  Bitwarden CLI is installed but not logged in.');
+                console.error('  Run: bw login');
+                process.exit(1);
+            }
+            if (status.status === 'locked') {
+                const session = process.env['BW_SESSION'];
+                if (!session) {
+                    console.error('  Bitwarden vault is locked.');
+                    console.error('  Run: export BW_SESSION=$(bw unlock --raw)');
+                    process.exit(1);
+                }
+                // Verify session works
+                try {
+                    execSync('bw sync', { stdio: 'pipe', env: { ...process.env, BW_SESSION: session } });
+                }
+                catch {
+                    console.error('  BW_SESSION is invalid or expired.');
+                    console.error('  Run: export BW_SESSION=$(bw unlock --raw)');
+                    process.exit(1);
+                }
+            }
+        }
+        catch {
+            console.error('  Bitwarden CLI not found.');
+            console.error('  Install: https://bitwarden.com/help/cli/');
+            console.error('  Then: bw login && export BW_SESSION=$(bw unlock --raw)');
+            process.exit(1);
+        }
+    }
     // 2. Run init internally (create dirs, config)
     ensureConfigDir();
     const config = getDefaultConfig();
@@ -625,7 +671,7 @@ program
     // 3. Prompt for API keys (or read from env in non-interactive mode)
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword || process.env['AQUAMAN_ENCRYPTION_PASSWORD'] || process.env['AQUAMAN_KEEPASS_PASSWORD'],
             vaultAddress: config.credentials.vaultAddress || process.env['VAULT_ADDR'],
@@ -633,7 +679,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (err) {
@@ -898,7 +947,16 @@ program
                 throw new Error('systemd-creds backend requires systemd >= 256 with --user support');
             }
         }
-        store = createCredentialStore({
+        if (config.credentials.backend === 'bitwarden') {
+            const { BitwardenStore } = await import('../core/credentials/backends/bitwarden.js');
+            if (!BitwardenStore.isAvailable()) {
+                throw new Error('Bitwarden CLI (bw) not found. Install: https://bitwarden.com/help/cli/');
+            }
+            if (!BitwardenStore.isUnlocked()) {
+                throw new Error('Bitwarden vault is locked. Run: export BW_SESSION=$(bw unlock --raw)');
+            }
+        }
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -906,7 +964,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
         // 3. Count credentials
         const creds = await store.list();
@@ -1266,7 +1327,7 @@ credentials
     const backend = options.backend || config.credentials.backend;
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1276,7 +1337,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch (error) {
@@ -1322,7 +1386,7 @@ credentials
     const config = loadConfig();
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1330,7 +1394,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch {
@@ -1354,7 +1421,7 @@ credentials
     const config = loadConfig();
     let store;
     try {
-        store = createCredentialStore({
+        store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1362,7 +1429,10 @@ credentials
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
     }
     catch {
@@ -1380,7 +1450,7 @@ credentials
 credentials
     .command('guide')
     .description('Show setup commands for seeding credentials based on your backend')
-    .option('--backend <backend>', 'Override backend (keychain, encrypted-file, vault, 1password)')
+    .option('--backend <backend>', 'Override backend (keychain, encrypted-file, keepassxc, 1password, vault, systemd-creds, bitwarden)')
     .option('--service <name>', 'Show commands for a single service only')
     .action(async (options) => {
     const config = loadConfig();
@@ -1701,7 +1771,7 @@ migrate
         // Migrate
         let store;
         try {
-            store = createCredentialStore({
+            store = await createCredentialStore({
                 backend: appConfig.credentials.backend,
                 encryptionPassword: appConfig.credentials.encryptionPassword,
                 vaultAddress: appConfig.credentials.vaultAddress,
@@ -1855,7 +1925,7 @@ migrate
     if (opts.dryRun) {
         console.log('(dry run - no credentials will be written)\n');
     }
-    const store = createCredentialStore({
+    const store = await createCredentialStore({
         backend: appConfig.credentials.backend,
         encryptionPassword: appConfig.credentials.encryptionPassword,
         vaultAddress: appConfig.credentials.vaultAddress,
@@ -1911,7 +1981,7 @@ program
     }
     // Check for stored credentials
     try {
-        const store = createCredentialStore({
+        const store = await createCredentialStore({
             backend: config.credentials.backend,
             encryptionPassword: config.credentials.encryptionPassword,
             vaultAddress: config.credentials.vaultAddress,
@@ -1919,7 +1989,10 @@ program
             onePasswordVault: config.credentials.onePasswordVault,
             onePasswordAccount: config.credentials.onePasswordAccount,
             keepassxcDatabasePath: config.credentials.keepassxcDatabasePath,
-            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath
+            keepassxcKeyFilePath: config.credentials.keepassxcKeyFilePath,
+            bitwardenFolder: config.credentials.bitwardenFolder,
+            bitwardenOrganizationId: config.credentials.bitwardenOrganizationId,
+            bitwardenCollectionId: config.credentials.bitwardenCollectionId
         });
         const creds = await store.list();
         console.log(`\nStored credentials: ${creds.length}`);