vw-keystroke 0.1.0__tar.gz

vw_keystroke-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PolyDevHouse LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vw_keystroke-0.1.0/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: vw-keystroke
+Version: 0.1.0
+Summary: Drop a secret once — into Vaultwarden/Bitwarden and a local 600 env file.
+Author: PolyDevHouse LLC
+License: MIT
+Project-URL: Homepage, https://github.com/PolyDevHouse/vw-keystroke
+Project-URL: Issues, https://github.com/PolyDevHouse/vw-keystroke/issues
+Keywords: vaultwarden,bitwarden,secrets,api-keys,dotenv,keyring
+Classifier: Environment :: X11 Applications
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: keyring>=24
+Dynamic: license-file
+
+<p align="center">
+  <img src="assets/rendered/vw-keystroke-256.png" width="120" alt="VW Keystroke">
+</p>
+
+<h1 align="center">VW Keystroke</h1>
+
+<p align="center">
+  <img src="https://img.shields.io/github/license/PolyDevHouse/vw-keystroke" alt="License: MIT">
+  <img src="https://img.shields.io/badge/python-3.9%2B-blue" alt="Python 3.9+">
+  <img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey" alt="Platforms">
+  <img src="https://img.shields.io/badge/vault-Vaultwarden%20%7C%20Bitwarden-175DDC" alt="Vaultwarden / Bitwarden">
+</p>
+
+**Paste a secret once — it lands in your [Vaultwarden](https://github.com/dani-garcia/vaultwarden)/Bitwarden vault *and* a local `600` env file, in one move.**
+
+Built for the "hot potato" moment: you just generated an API key and you want it
+*off your clipboard and safely stored* without a five-step ritual — so it doesn't
+end up lingering in a scratch file. Name it, paste it, done.
+
+- 🗄️ Saves to your vault as a **Login** item (username = the env var, password = the value, with the env-file path recorded as a custom field).
+- 📄 Writes `~/.config/<project>.env` (`chmod 600`, updated in place — never duplicated).
+- 🔒 **Zero-knowledge**: your master password never leaves your machine; all vault crypto is done by the official `bw` CLI.
+- ⚡ Caches the unlocked session in your **OS keyring** (Windows Credential Locker / macOS Keychain / Linux libsecret) so daily use needs no password.
+- 🖥️ **GUI** and **CLI**, on **Windows / Linux / macOS**.
+
+> The secret value is never passed on the command line and never echoed — only
+> the `600` env file and your vault ever see it.
+
+---
+
+## Requirements
+
+1. **[Bitwarden CLI](https://bitwarden.com/help/cli/)** — `npm install -g @bitwarden/cli` (provides `bw`).
+2. **Python 3.9+** (Tkinter ships with the standard python.org installers).
+
+## Install
+
+```bash
+# From GitHub (works today):
+pipx install git+https://github.com/PolyDevHouse/vw-keystroke
+# or
+pip install --user git+https://github.com/PolyDevHouse/vw-keystroke
+```
+
+> _PyPI release coming soon — then `pipx install vw-keystroke` will Just Work._
+
+This gives you three commands: `vwks` (CLI), `keydrop` (alias), and `vwks-gui` (GUI).
+
+### First-time setup
+
+```bash
+# point bw at your server (self-hosted Vaultwarden, or Bitwarden cloud)
+bw config server https://vault.example.com
+bw login                          # email + master password + 2FA (once)
+
+# optional config
+mkdir -p ~/.config
+cp vw-keystroke.conf.example ~/.config/vw-keystroke.conf && chmod 600 ~/.config/vw-keystroke.conf
+```
+
+## Use
+
+**GUI:** launch **VW Keystroke** from your app menu (Linux `.desktop` in
+[`packaging/`](packaging/)), or run `vwks-gui`.
+
+**CLI:**
+```bash
+vwks OPENAI_API_KEY                 # prompts (hidden) for the value
+vwks OPENAI_API_KEY --project openai   # -> ~/.config/openai.env
+echo -n "$SECRET" | vwks --var FOO --project bar   # piped / non-interactive
+vwks --lock                         # forget the cached session + lock now
+```
+
+## Configuration
+
+`~/.config/vw-keystroke.conf` (all optional — see [`vw-keystroke.conf.example`](vw-keystroke.conf.example)):
+
+| Key | Meaning | Default |
+|-----|---------|---------|
+| `BW_SERVER` | Vault server URL | current `bw` config |
+| `DEFAULT_PROJECT` | env-file basename | `keys` |
+| `VAULT_FOLDER` | folder for new items | `API Keys` |
+| `KEYRING_TTL_DAYS` | cached-session lifetime (`0` = never cache) | `30` |
+| `ENV_DIR` | where env files go | `~/.config` |
+| `BW_CLIENTID` / `BW_CLIENTSECRET` | optional API-key login | — |
+
+## How it works
+
+`bw` handles login and all encryption. On a drop, VW Keystroke unlocks (or reuses a
+cached session), then creates/updates the vault item and the env file. If the vault
+is locked it asks for your master password once; the resulting session key is stored
+in your OS keyring with a TTL and refreshed on use.
+
+## Security notes
+
+- Nothing sensitive is stored by this tool except the `600` env file you asked for and the keyring session (same protection as your desktop login).
+- A cached session means anyone at your already-unlocked machine can drop/read keys — the same exposure as a logged-in browser vault extension. Set `KEYRING_TTL_DAYS=0` to disable caching.
+- This project ships **no** credentials, servers, or keys of its own.
+
+## License
+
+MIT © PolyDevHouse LLC

vw_keystroke-0.1.0/README.md

@@ -0,0 +1,102 @@
+<p align="center">
+  <img src="assets/rendered/vw-keystroke-256.png" width="120" alt="VW Keystroke">
+</p>
+
+<h1 align="center">VW Keystroke</h1>
+
+<p align="center">
+  <img src="https://img.shields.io/github/license/PolyDevHouse/vw-keystroke" alt="License: MIT">
+  <img src="https://img.shields.io/badge/python-3.9%2B-blue" alt="Python 3.9+">
+  <img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey" alt="Platforms">
+  <img src="https://img.shields.io/badge/vault-Vaultwarden%20%7C%20Bitwarden-175DDC" alt="Vaultwarden / Bitwarden">
+</p>
+
+**Paste a secret once — it lands in your [Vaultwarden](https://github.com/dani-garcia/vaultwarden)/Bitwarden vault *and* a local `600` env file, in one move.**
+
+Built for the "hot potato" moment: you just generated an API key and you want it
+*off your clipboard and safely stored* without a five-step ritual — so it doesn't
+end up lingering in a scratch file. Name it, paste it, done.
+
+- 🗄️ Saves to your vault as a **Login** item (username = the env var, password = the value, with the env-file path recorded as a custom field).
+- 📄 Writes `~/.config/<project>.env` (`chmod 600`, updated in place — never duplicated).
+- 🔒 **Zero-knowledge**: your master password never leaves your machine; all vault crypto is done by the official `bw` CLI.
+- ⚡ Caches the unlocked session in your **OS keyring** (Windows Credential Locker / macOS Keychain / Linux libsecret) so daily use needs no password.
+- 🖥️ **GUI** and **CLI**, on **Windows / Linux / macOS**.
+
+> The secret value is never passed on the command line and never echoed — only
+> the `600` env file and your vault ever see it.
+
+---
+
+## Requirements
+
+1. **[Bitwarden CLI](https://bitwarden.com/help/cli/)** — `npm install -g @bitwarden/cli` (provides `bw`).
+2. **Python 3.9+** (Tkinter ships with the standard python.org installers).
+
+## Install
+
+```bash
+# From GitHub (works today):
+pipx install git+https://github.com/PolyDevHouse/vw-keystroke
+# or
+pip install --user git+https://github.com/PolyDevHouse/vw-keystroke
+```
+
+> _PyPI release coming soon — then `pipx install vw-keystroke` will Just Work._
+
+This gives you three commands: `vwks` (CLI), `keydrop` (alias), and `vwks-gui` (GUI).
+
+### First-time setup
+
+```bash
+# point bw at your server (self-hosted Vaultwarden, or Bitwarden cloud)
+bw config server https://vault.example.com
+bw login                          # email + master password + 2FA (once)
+
+# optional config
+mkdir -p ~/.config
+cp vw-keystroke.conf.example ~/.config/vw-keystroke.conf && chmod 600 ~/.config/vw-keystroke.conf
+```
+
+## Use
+
+**GUI:** launch **VW Keystroke** from your app menu (Linux `.desktop` in
+[`packaging/`](packaging/)), or run `vwks-gui`.
+
+**CLI:**
+```bash
+vwks OPENAI_API_KEY                 # prompts (hidden) for the value
+vwks OPENAI_API_KEY --project openai   # -> ~/.config/openai.env
+echo -n "$SECRET" | vwks --var FOO --project bar   # piped / non-interactive
+vwks --lock                         # forget the cached session + lock now
+```
+
+## Configuration
+
+`~/.config/vw-keystroke.conf` (all optional — see [`vw-keystroke.conf.example`](vw-keystroke.conf.example)):
+
+| Key | Meaning | Default |
+|-----|---------|---------|
+| `BW_SERVER` | Vault server URL | current `bw` config |
+| `DEFAULT_PROJECT` | env-file basename | `keys` |
+| `VAULT_FOLDER` | folder for new items | `API Keys` |
+| `KEYRING_TTL_DAYS` | cached-session lifetime (`0` = never cache) | `30` |
+| `ENV_DIR` | where env files go | `~/.config` |
+| `BW_CLIENTID` / `BW_CLIENTSECRET` | optional API-key login | — |
+
+## How it works
+
+`bw` handles login and all encryption. On a drop, VW Keystroke unlocks (or reuses a
+cached session), then creates/updates the vault item and the env file. If the vault
+is locked it asks for your master password once; the resulting session key is stored
+in your OS keyring with a TTL and refreshed on use.
+
+## Security notes
+
+- Nothing sensitive is stored by this tool except the `600` env file you asked for and the keyring session (same protection as your desktop login).
+- A cached session means anyone at your already-unlocked machine can drop/read keys — the same exposure as a logged-in browser vault extension. Set `KEYRING_TTL_DAYS=0` to disable caching.
+- This project ships **no** credentials, servers, or keys of its own.
+
+## License
+
+MIT © PolyDevHouse LLC

vw_keystroke-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vw-keystroke"
+version = "0.1.0"
+description = "Drop a secret once — into Vaultwarden/Bitwarden and a local 600 env file."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "PolyDevHouse LLC" }]
+keywords = ["vaultwarden", "bitwarden", "secrets", "api-keys", "dotenv", "keyring"]
+classifiers = [
+  "Environment :: X11 Applications",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Topic :: Security",
+  "Topic :: Utilities",
+]
+dependencies = ["keyring>=24"]
+
+[project.urls]
+Homepage = "https://github.com/PolyDevHouse/vw-keystroke"
+Issues = "https://github.com/PolyDevHouse/vw-keystroke/issues"
+
+[project.scripts]
+vwks = "vwkeystroke.cli:main"
+keydrop = "vwkeystroke.cli:main"
+
+[project.gui-scripts]
+vwks-gui = "vwkeystroke.gui:main"
+
+[tool.setuptools]
+packages = ["vwkeystroke"]

vw_keystroke-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vw_keystroke-0.1.0/vw_keystroke.egg-info/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: vw-keystroke
+Version: 0.1.0
+Summary: Drop a secret once — into Vaultwarden/Bitwarden and a local 600 env file.
+Author: PolyDevHouse LLC
+License: MIT
+Project-URL: Homepage, https://github.com/PolyDevHouse/vw-keystroke
+Project-URL: Issues, https://github.com/PolyDevHouse/vw-keystroke/issues
+Keywords: vaultwarden,bitwarden,secrets,api-keys,dotenv,keyring
+Classifier: Environment :: X11 Applications
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: keyring>=24
+Dynamic: license-file
+
+<p align="center">
+  <img src="assets/rendered/vw-keystroke-256.png" width="120" alt="VW Keystroke">
+</p>
+
+<h1 align="center">VW Keystroke</h1>
+
+<p align="center">
+  <img src="https://img.shields.io/github/license/PolyDevHouse/vw-keystroke" alt="License: MIT">
+  <img src="https://img.shields.io/badge/python-3.9%2B-blue" alt="Python 3.9+">
+  <img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey" alt="Platforms">
+  <img src="https://img.shields.io/badge/vault-Vaultwarden%20%7C%20Bitwarden-175DDC" alt="Vaultwarden / Bitwarden">
+</p>
+
+**Paste a secret once — it lands in your [Vaultwarden](https://github.com/dani-garcia/vaultwarden)/Bitwarden vault *and* a local `600` env file, in one move.**
+
+Built for the "hot potato" moment: you just generated an API key and you want it
+*off your clipboard and safely stored* without a five-step ritual — so it doesn't
+end up lingering in a scratch file. Name it, paste it, done.
+
+- 🗄️ Saves to your vault as a **Login** item (username = the env var, password = the value, with the env-file path recorded as a custom field).
+- 📄 Writes `~/.config/<project>.env` (`chmod 600`, updated in place — never duplicated).
+- 🔒 **Zero-knowledge**: your master password never leaves your machine; all vault crypto is done by the official `bw` CLI.
+- ⚡ Caches the unlocked session in your **OS keyring** (Windows Credential Locker / macOS Keychain / Linux libsecret) so daily use needs no password.
+- 🖥️ **GUI** and **CLI**, on **Windows / Linux / macOS**.
+
+> The secret value is never passed on the command line and never echoed — only
+> the `600` env file and your vault ever see it.
+
+---
+
+## Requirements
+
+1. **[Bitwarden CLI](https://bitwarden.com/help/cli/)** — `npm install -g @bitwarden/cli` (provides `bw`).
+2. **Python 3.9+** (Tkinter ships with the standard python.org installers).
+
+## Install
+
+```bash
+# From GitHub (works today):
+pipx install git+https://github.com/PolyDevHouse/vw-keystroke
+# or
+pip install --user git+https://github.com/PolyDevHouse/vw-keystroke
+```
+
+> _PyPI release coming soon — then `pipx install vw-keystroke` will Just Work._
+
+This gives you three commands: `vwks` (CLI), `keydrop` (alias), and `vwks-gui` (GUI).
+
+### First-time setup
+
+```bash
+# point bw at your server (self-hosted Vaultwarden, or Bitwarden cloud)
+bw config server https://vault.example.com
+bw login                          # email + master password + 2FA (once)
+
+# optional config
+mkdir -p ~/.config
+cp vw-keystroke.conf.example ~/.config/vw-keystroke.conf && chmod 600 ~/.config/vw-keystroke.conf
+```
+
+## Use
+
+**GUI:** launch **VW Keystroke** from your app menu (Linux `.desktop` in
+[`packaging/`](packaging/)), or run `vwks-gui`.
+
+**CLI:**
+```bash
+vwks OPENAI_API_KEY                 # prompts (hidden) for the value
+vwks OPENAI_API_KEY --project openai   # -> ~/.config/openai.env
+echo -n "$SECRET" | vwks --var FOO --project bar   # piped / non-interactive
+vwks --lock                         # forget the cached session + lock now
+```
+
+## Configuration
+
+`~/.config/vw-keystroke.conf` (all optional — see [`vw-keystroke.conf.example`](vw-keystroke.conf.example)):
+
+| Key | Meaning | Default |
+|-----|---------|---------|
+| `BW_SERVER` | Vault server URL | current `bw` config |
+| `DEFAULT_PROJECT` | env-file basename | `keys` |
+| `VAULT_FOLDER` | folder for new items | `API Keys` |
+| `KEYRING_TTL_DAYS` | cached-session lifetime (`0` = never cache) | `30` |
+| `ENV_DIR` | where env files go | `~/.config` |
+| `BW_CLIENTID` / `BW_CLIENTSECRET` | optional API-key login | — |
+
+## How it works
+
+`bw` handles login and all encryption. On a drop, VW Keystroke unlocks (or reuses a
+cached session), then creates/updates the vault item and the env file. If the vault
+is locked it asks for your master password once; the resulting session key is stored
+in your OS keyring with a TTL and refreshed on use.
+
+## Security notes
+
+- Nothing sensitive is stored by this tool except the `600` env file you asked for and the keyring session (same protection as your desktop login).
+- A cached session means anyone at your already-unlocked machine can drop/read keys — the same exposure as a logged-in browser vault extension. Set `KEYRING_TTL_DAYS=0` to disable caching.
+- This project ships **no** credentials, servers, or keys of its own.
+
+## License
+
+MIT © PolyDevHouse LLC

vw_keystroke-0.1.0/vw_keystroke.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+vw_keystroke.egg-info/PKG-INFO
+vw_keystroke.egg-info/SOURCES.txt
+vw_keystroke.egg-info/dependency_links.txt
+vw_keystroke.egg-info/entry_points.txt
+vw_keystroke.egg-info/requires.txt
+vw_keystroke.egg-info/top_level.txt
+vwkeystroke/__init__.py
+vwkeystroke/cli.py
+vwkeystroke/core.py
+vwkeystroke/gui.py

vw_keystroke-0.1.0/vw_keystroke.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

vw_keystroke-0.1.0/vw_keystroke.egg-info/entry_points.txt

@@ -0,0 +1,6 @@
+[console_scripts]
+keydrop = vwkeystroke.cli:main
+vwks = vwkeystroke.cli:main
+
+[gui_scripts]
+vwks-gui = vwkeystroke.gui:main

vw_keystroke-0.1.0/vw_keystroke.egg-info/requires.txt

@@ -0,0 +1 @@
+keyring>=24

vw_keystroke-0.1.0/vw_keystroke.egg-info/top_level.txt

@@ -0,0 +1 @@
+vwkeystroke

vw_keystroke-0.1.0/vwkeystroke/__init__.py

@@ -0,0 +1,2 @@
+"""VW Keystroke — drop a secret once, into Vaultwarden + a local 600 env file."""
+__version__ = "0.1.0"

vw_keystroke-0.1.0/vwkeystroke/cli.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""VW Keystroke CLI — `vwks` (alias `keydrop`).
+
+  vwks OPENAI_API_KEY                 # positional var, prompts for value
+  vwks --var FOO --project bar
+  echo -n "$SECRET" | vwks --var FOO --project bar   # non-interactive
+  vwks --lock                         # forget cached session + lock
+"""
+import argparse, sys
+from getpass import getpass
+from . import core
+
+
+def _read_value():
+    if not sys.stdin.isatty():
+        v = sys.stdin.readline().rstrip("\n")
+    else:
+        v = getpass("Paste value (hidden): ")
+    if not v:
+        sys.exit("vwks: empty value — nothing to store")
+    return v
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(prog="vwks",
+                                 description="Store a secret in a 600 env file + Vaultwarden/Bitwarden.")
+    ap.add_argument("var_pos", nargs="?", help="ENV var name (positional shortcut)")
+    ap.add_argument("--var")
+    ap.add_argument("--project")
+    ap.add_argument("--name", help="vault item name (default: the ENV var name)")
+    ap.add_argument("--folder")
+    ap.add_argument("--env-dir")
+    ap.add_argument("--no-vault", action="store_true", help="write env file only")
+    ap.add_argument("--lock", action="store_true", help="forget cached session + lock, then exit")
+    a = ap.parse_args(argv)
+
+    if a.lock:
+        core.lock()
+        print("→ cached session cleared; vault locked")
+        return 0
+
+    conf = core.load_conf()
+    interactive = sys.stdin.isatty()
+    var = a.var or a.var_pos or (input("Env var name: ").strip() if interactive else "")
+    if not core.valid_var(var):
+        sys.exit(f"vwks: invalid/empty env var name: {var!r}")
+    proj_default = core.default_project(conf)
+    project = a.project or (input(f"Project [{proj_default}]: ").strip() if interactive else "") or proj_default
+
+    value = _read_value()
+
+    mp = None
+    while True:
+        try:
+            res = core.drop(var, value, project=project, name=a.name, folder=a.folder,
+                            env_dir_=a.env_dir, no_vault=a.no_vault, master_password=mp, conf=conf)
+            break
+        except core.NeedUnlock:
+            if not interactive:
+                sys.exit("vwks: vault locked and no TTY to prompt for master password")
+            mp = getpass("Vault master password (hidden): ")
+        except core.NeedLogin as e:
+            sys.exit(f"vwks: {e}")
+        except core.VwksError as e:
+            sys.exit(f"vwks: {e}")
+
+    print(f"→ {res['env_action']} {var} in {res['env_path']} (600)")
+    if res["vault"]:
+        print(f'→ Vaultwarden: {res["vault"]} login "{a.name or var}" in folder "{res["folder"]}" ✓')
+    else:
+        print("→ vault skipped (--no-vault)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

vw_keystroke-0.1.0/vwkeystroke/core.py

@@ -0,0 +1,347 @@
+"""VW Keystroke — shared core for the CLI and GUI.
+
+Paste a secret once; it lands in a 600 env file AND in your Vaultwarden (or
+Bitwarden) vault. Wraps the `bw` CLI (which handles all the vault crypto). The
+unlocked session is cached in the OS keyring (Windows Credential Locker / macOS
+Keychain / libsecret) so day-to-day use is just: name it, paste it.
+
+No secret value is ever passed on argv or written anywhere but the env file
+(600) and the vault.
+"""
+from __future__ import annotations
+import base64, json, os, re, shutil, subprocess, tempfile, time
+
+try:
+    import keyring as _keyring  # cross-platform session cache
+except Exception:  # pragma: no cover - optional
+    _keyring = None
+
+APP = "vw-keystroke"
+KR_SERVICE = "vw-keystroke"
+KR_ACCOUNT = "bw-session"
+
+# Config search order: explicit env var, XDG-ish path, then the legacy keydrop name.
+CONFIG_PATHS = [
+    os.environ.get("VWKS_CONFIG"),
+    os.path.expanduser("~/.config/vw-keystroke.conf"),
+    os.path.expanduser("~/.config/keydrop.conf"),
+]
+
+
+def _dbg(msg: str):
+    if not os.environ.get("VWKS_DEBUG"):
+        return
+    try:
+        with open("/tmp/vwks-debug.log", "a", encoding="utf-8") as f:
+            f.write(f"{time.time():.0f}  {msg}\n")
+    except Exception:
+        pass
+
+
+class VwksError(Exception):
+    pass
+
+
+class NeedUnlock(VwksError):
+    """Vault is logged in but locked — a master password is required."""
+
+
+class NeedLogin(VwksError):
+    """Not logged in and no API key configured — run `bw login` once."""
+
+
+# ---------- config ----------
+def config_path() -> str:
+    for p in CONFIG_PATHS:
+        if p and os.path.exists(p):
+            return p
+    return os.path.expanduser("~/.config/vw-keystroke.conf")
+
+
+def load_conf() -> dict:
+    conf = {}
+    p = config_path()
+    if os.path.exists(p):
+        for ln in open(p, encoding="utf-8"):
+            ln = ln.strip()
+            if ln and not ln.startswith("#") and "=" in ln:
+                k, v = ln.split("=", 1)
+                conf[k.strip()] = v.strip().strip('"').strip("'")
+    return conf
+
+
+def env_dir(conf: dict | None = None) -> str:
+    conf = conf or {}
+    return os.path.expanduser(conf.get("ENV_DIR") or "~/.config")
+
+
+def default_project(conf: dict) -> str:
+    return conf.get("DEFAULT_PROJECT", "keys")
+
+
+def list_projects(edir: str) -> list[str]:
+    try:
+        return sorted(f[:-4] for f in os.listdir(edir) if f.endswith(".env"))
+    except FileNotFoundError:
+        return []
+
+
+# ---------- env file ----------
+def valid_var(var: str) -> bool:
+    return bool(re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", var or ""))
+
+
+def write_env(edir: str, project: str, var: str, value: str) -> tuple[str, str]:
+    path = os.path.join(os.path.expanduser(edir), f"{project}.env")
+    lines = open(path, encoding="utf-8").read().splitlines() if os.path.exists(path) else []
+    out, found = [], False
+    pat = re.compile(rf"^\s*{re.escape(var)}\s*=")
+    for ln in lines:
+        if pat.match(ln):
+            out.append(f"{var}={value}"); found = True
+        else:
+            out.append(ln)
+    if not found:
+        out.append(f"{var}={value}")
+    d = os.path.dirname(path) or "."
+    os.makedirs(d, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=d)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write("\n".join(out) + "\n")
+    try:
+        os.chmod(tmp, 0o600)
+    except OSError:
+        pass  # Windows: perms are a no-op
+    os.replace(tmp, path)
+    try:
+        os.chmod(path, 0o600)
+    except OSError:
+        pass
+    return path, ("updated" if found else "added")
+
+
+# ---------- bw plumbing ----------
+def find_bw() -> str:
+    b = shutil.which("bw")
+    if b:
+        return b
+    for cand in [
+        os.path.expanduser("~/.npm-global/bin/bw"),
+        "/usr/local/bin/bw",
+        os.path.expandvars(r"%APPDATA%\npm\bw.cmd"),
+    ]:
+        if cand and os.path.exists(cand):
+            return cand
+    raise VwksError("bw CLI not found. Install it: npm install -g @bitwarden/cli")
+
+
+def _run(bw, args, env, check=True):
+    r = subprocess.run([bw] + args, capture_output=True, text=True, env=env)
+    if check and r.returncode != 0:
+        raise VwksError(f"bw {args[0]} failed: {r.stderr.strip()[:200]}")
+    return r
+
+
+def bw_status(bw, env) -> str:
+    r = _run(bw, ["status"], env, check=False)
+    try:
+        return json.loads(r.stdout).get("status", "unknown")
+    except Exception:
+        return "unknown"
+
+
+def _base_env(conf) -> dict:
+    return dict(os.environ)
+
+
+def _ensure_server(bw, conf, env):
+    url = conf.get("BW_SERVER")
+    if url:
+        _run(bw, ["config", "server", url], env, check=False)
+
+
+# ---------- keyring session cache ----------
+def _ttl_days(conf) -> int:
+    try:
+        return int(conf.get("KEYRING_TTL_DAYS", "30") or 0)
+    except ValueError:
+        return 30
+
+
+def kr_get() -> str | None:
+    if not _keyring:
+        return None
+    try:
+        raw = _keyring.get_password(KR_SERVICE, KR_ACCOUNT)
+    except Exception:
+        return None
+    if not raw:
+        return None
+    try:
+        d = json.loads(raw)
+    except Exception:
+        return None
+    if d.get("exp", 0) < time.time():
+        kr_clear()
+        return None
+    return d.get("session")
+
+
+def kr_store(session: str, ttl_days: int):
+    if not _keyring or ttl_days <= 0 or not session:
+        return
+    try:
+        _keyring.set_password(KR_SERVICE, KR_ACCOUNT,
+                              json.dumps({"session": session, "exp": time.time() + ttl_days * 86400}))
+    except Exception:
+        pass
+
+
+def kr_clear():
+    if not _keyring:
+        return
+    try:
+        _keyring.delete_password(KR_SERVICE, KR_ACCOUNT)
+    except Exception:
+        pass
+
+
+def _session_ok(bw, base_env, sess) -> bool:
+    """Validate a session by running a real op that requires an unlocked vault.
+    `bw status` is unreliable here — recent bw versions report the on-disk lock
+    state and return "locked" even with a valid session in the environment, so we
+    probe with `bw list folders` instead. stdin is closed so an invalid session
+    fails fast (returns non-zero) rather than dropping into an interactive prompt."""
+    if not sess:
+        return False
+    try:
+        r = subprocess.run([bw, "list", "folders", "--session", sess],
+                           env=dict(base_env, BW_SESSION=sess),
+                           capture_output=True, text=True,
+                           stdin=subprocess.DEVNULL, timeout=30)
+    except Exception:
+        return False
+    return r.returncode == 0 and r.stdout.strip().startswith("[")
+
+
+def session_state(conf: dict | None = None) -> str:
+    """'ready' (cached session), 'locked' (need master pw), 'apikey' (can auto-login),
+    'login' (need one-time `bw login`)."""
+    conf = conf or load_conf()
+    try:
+        bw = find_bw()
+    except VwksError:
+        return "login"
+    base = _base_env(conf)
+    if _session_ok(bw, base, kr_get()):
+        return "ready"
+    if bw_status(bw, base) == "unauthenticated":
+        cid, csec = conf.get("BW_CLIENTID"), conf.get("BW_CLIENTSECRET")
+        return "apikey" if (cid and csec and "xxxx" not in (cid + csec)) else "login"
+    return "locked"
+
+
+def _ensure_session(bw, base_env, conf, master_password=None) -> str:
+    sess = kr_get()
+    _dbg(f"ensure: kr_get -> {'HIT' if sess else 'miss'}; keyring={bool(_keyring)}")
+    if _session_ok(bw, base_env, sess):
+        _dbg("ensure: cached session VALID -> reuse")
+        kr_store(sess, _ttl_days(conf))  # idle-refresh
+        return sess
+    st = bw_status(bw, base_env)
+    _dbg(f"ensure: cache miss/invalid; bw status(no-session)={st}")
+    if st == "unauthenticated":
+        _ensure_server(bw, conf, base_env)
+        cid, csec = conf.get("BW_CLIENTID"), conf.get("BW_CLIENTSECRET")
+        if cid and csec and "xxxx" not in (cid + csec):
+            _run(bw, ["login", "--apikey"], dict(base_env, BW_CLIENTID=cid, BW_CLIENTSECRET=csec))
+        else:
+            raise NeedLogin("Not logged in. Run `bw login` once in a terminal, then retry.")
+    if master_password is None:
+        _dbg("ensure: NeedUnlock (no master password provided)")
+        raise NeedUnlock("Vault is locked — a master password is required.")
+    r = _run(bw, ["unlock", "--passwordenv", "BW_PASSWORD", "--raw"],
+             dict(base_env, BW_PASSWORD=master_password))
+    sess = r.stdout.strip()
+    _dbg(f"ensure: unlock done; session_len={len(sess)}")
+    if not sess:
+        raise VwksError("unlock returned no session (wrong master password?)")
+    kr_store(sess, _ttl_days(conf))
+    back = kr_get()
+    _dbg(f"ensure: kr_store done; readback={'OK' if back == sess else 'MISMATCH/none'}; "
+         f"revalidate={_session_ok(bw, base_env, sess)}")
+    return sess
+
+
+# ---------- vault item upsert ----------
+def _folder_id(bw, env, name):
+    if not name:
+        return None
+    r = _run(bw, ["list", "folders", "--search", name], env)
+    for f in json.loads(r.stdout or "[]"):
+        if f.get("name") == name:
+            return f["id"]
+    enc = base64.b64encode(json.dumps({"name": name}).encode()).decode()
+    return json.loads(_run(bw, ["create", "folder", enc], env).stdout)["id"]
+
+
+def _find_item(bw, env, name, var):
+    r = _run(bw, ["list", "items", "--search", name], env)
+    for it in json.loads(r.stdout or "[]"):
+        if it.get("name") == name and (it.get("login") or {}).get("username") in (var, None, ""):
+            return it
+    return None
+
+
+def _vault_upsert(bw, env, name, var, value, env_path, fid):
+    field = {"name": "env_file", "value": env_path, "type": 0, "linkedId": None}
+    existing = _find_item(bw, env, name, var)
+    if existing:
+        it = existing
+        it["login"] = {**(it.get("login") or {}), "username": var, "password": value}
+        it["fields"] = [f for f in (it.get("fields") or []) if f.get("name") != "env_file"] + [field]
+        it["folderId"] = it.get("folderId") or fid
+        enc = base64.b64encode(json.dumps(it).encode()).decode()
+        _run(bw, ["edit", "item", it["id"], enc], env)
+        return "updated"
+    it = {"organizationId": None, "collectionIds": None, "folderId": fid, "type": 1,
+          "name": name, "notes": None, "favorite": False, "fields": [field],
+          "login": {"username": var, "password": value, "totp": None, "uris": []}, "reprompt": 0}
+    enc = base64.b64encode(json.dumps(it).encode()).decode()
+    _run(bw, ["create", "item", enc], env)
+    return "created"
+
+
+# ---------- top-level ----------
+def drop(var, value, *, project, name=None, folder=None, env_dir_=None,
+         no_vault=False, master_password=None, conf=None) -> dict:
+    """Write the secret to the env file and (unless no_vault) upsert it into the vault.
+    May raise NeedUnlock / NeedLogin so the caller can prompt and retry."""
+    conf = conf if conf is not None else load_conf()
+    if not valid_var(var):
+        raise VwksError(f"invalid env var name: {var!r}")
+    edir = env_dir_ or env_dir(conf)
+    path, action = write_env(edir, project, var, value)
+    result = {"env_path": path, "env_action": action, "vault": None, "folder": None}
+    if no_vault:
+        return result
+    bw = find_bw()
+    base_env = _base_env(conf)
+    sess = _ensure_session(bw, base_env, conf, master_password)
+    venv = dict(base_env, BW_SESSION=sess)
+    _run(bw, ["sync"], venv, check=False)
+    folder = folder or conf.get("VAULT_FOLDER", "API Keys")
+    fid = _folder_id(bw, venv, folder)
+    result["vault"] = _vault_upsert(bw, venv, name or var, var, value, path, fid)
+    result["folder"] = folder
+    return result
+
+
+def lock():
+    """Forget the cached session and lock the vault."""
+    kr_clear()
+    try:
+        bw = find_bw()
+        _run(bw, ["lock"], _base_env(load_conf()), check=False)
+    except VwksError:
+        pass

vw_keystroke-0.1.0/vwkeystroke/gui.py

@@ -0,0 +1,252 @@
+#!/usr/bin/env python3
+"""VW Keystroke GUI — a small dark Tkinter window: name it, paste it, drop it.
+
+Writes the secret to a 600 env file and (optionally) upserts it into Vaultwarden/
+Bitwarden. Vault work runs on a worker thread so the UI never freezes.
+"""
+import threading
+import tkinter as tk
+from tkinter import ttk, messagebox, simpledialog
+from . import core
+
+BG = "#0f1420"
+CARD = "#161c28"
+FIELD = "#0b0f17"
+FG = "#e6edf3"
+MUTED = "#8b97a7"
+ACCENT = "#2fbf71"
+ACCENT_HI = "#3ad684"
+DANGER = "#e5534b"
+BORDER = "#243044"
+FONT = ("Segoe UI", 11) if tk.TkVersion else ("sans-serif", 11)
+MONO = ("JetBrains Mono", 10)
+
+
+class App(tk.Tk):
+    def __init__(self):
+        super().__init__()
+        self.title("VW Keystroke")
+        self.configure(bg=BG)
+        self.resizable(False, False)
+        try:
+            self.tk.call("tk", "scaling", 1.25)
+        except Exception:
+            pass
+        self.conf = core.load_conf()
+        self._busy = False
+        self._build()
+        self._refresh_status()
+
+    # ---------- UI ----------
+    def _label(self, parent, text):
+        return tk.Label(parent, text=text, bg=CARD, fg=MUTED,
+                        font=("Segoe UI", 9, "bold"), anchor="w")
+
+    def _entry(self, parent, show=None, textvariable=None):
+        e = tk.Entry(parent, bg=FIELD, fg=FG, insertbackground=ACCENT,
+                     relief="flat", font=("Segoe UI", 11), show=show or "",
+                     highlightthickness=1, highlightbackground=BORDER,
+                     highlightcolor=ACCENT, textvariable=textvariable)
+        e.configure(bd=6)
+        return e
+
+    def _build(self):
+        pad = dict(padx=22)
+        # header
+        head = tk.Frame(self, bg=BG)
+        head.pack(fill="x", pady=(18, 6), **pad)
+        tk.Label(head, text="🔑  VW Keystroke", bg=BG, fg=FG,
+                 font=("Segoe UI", 17, "bold")).pack(side="left")
+        self.status_pill = tk.Label(head, text="…", bg=BG, fg=MUTED,
+                                     font=("Segoe UI", 9, "bold"))
+        self.status_pill.pack(side="right", pady=(6, 0))
+        tk.Label(self, text="Paste a secret → local env file + your vault.",
+                 bg=BG, fg=MUTED, font=("Segoe UI", 10)).pack(anchor="w", **pad)
+
+        card = tk.Frame(self, bg=CARD, highlightthickness=1,
+                        highlightbackground=BORDER)
+        card.pack(fill="both", expand=True, padx=18, pady=14)
+        inner = tk.Frame(card, bg=CARD)
+        inner.pack(fill="both", expand=True, padx=18, pady=16)
+
+        # env var
+        self._label(inner, "ENV VARIABLE NAME").pack(fill="x")
+        self.var_e = self._entry(inner)
+        self.var_e.pack(fill="x", pady=(3, 12))
+
+        # project (combobox of existing + free text)
+        self._label(inner, "PROJECT  →  ~/.config/<project>.env").pack(fill="x")
+        edir = core.env_dir(self.conf)
+        projects = core.list_projects(edir)
+        self.proj_v = tk.StringVar(value=core.default_project(self.conf))
+        self.option_add("*TCombobox*Listbox.background", FIELD)
+        self.option_add("*TCombobox*Listbox.foreground", FG)
+        self.option_add("*TCombobox*Listbox.selectBackground", ACCENT)
+        style = ttk.Style(self)
+        try:
+            style.theme_use("clam")
+        except Exception:
+            pass
+        style.configure("VW.TCombobox", fieldbackground=FIELD, background=FIELD,
+                        foreground=FG, arrowcolor=MUTED, bordercolor=BORDER,
+                        lightcolor=BORDER, darkcolor=BORDER)
+        self.proj_e = ttk.Combobox(inner, textvariable=self.proj_v, values=projects,
+                                   style="VW.TCombobox", font=("Segoe UI", 11))
+        self.proj_e.pack(fill="x", pady=(3, 12), ipady=3)
+
+        # vault item name (optional)
+        self._label(inner, "VAULT ITEM NAME  (blank = same as variable)").pack(fill="x")
+        self.name_e = self._entry(inner)
+        self.name_e.pack(fill="x", pady=(3, 12))
+
+        # secret
+        self._label(inner, "SECRET VALUE").pack(fill="x")
+        row = tk.Frame(inner, bg=CARD)
+        row.pack(fill="x", pady=(3, 6))
+        self.secret_e = self._entry(row, show="•")
+        self.secret_e.pack(side="left", fill="x", expand=True)
+        self.show_v = tk.IntVar(value=0)
+        tk.Checkbutton(row, text="show", variable=self.show_v, command=self._toggle_show,
+                       bg=CARD, fg=MUTED, selectcolor=FIELD, activebackground=CARD,
+                       activeforeground=FG, font=("Segoe UI", 9), bd=0,
+                       highlightthickness=0).pack(side="left", padx=(8, 0))
+
+        # also-to-vault toggle
+        self.vault_v = tk.IntVar(value=1)
+        tk.Checkbutton(inner, text="Also save to Vaultwarden", variable=self.vault_v,
+                       bg=CARD, fg=FG, selectcolor=FIELD, activebackground=CARD,
+                       activeforeground=FG, font=("Segoe UI", 10), bd=0,
+                       highlightthickness=0).pack(anchor="w", pady=(6, 10))
+
+        # buttons
+        btns = tk.Frame(inner, bg=CARD)
+        btns.pack(fill="x")
+        self.drop_b = tk.Button(btns, text="Drop it  ⏎", command=self.on_drop,
+                                bg=ACCENT, fg="#062a17", activebackground=ACCENT_HI,
+                                activeforeground="#062a17", relief="flat",
+                                font=("Segoe UI", 11, "bold"), bd=0, padx=16, pady=8,
+                                cursor="hand2")
+        self.drop_b.pack(side="left")
+        tk.Button(btns, text="Lock", command=self.on_lock, bg=CARD, fg=MUTED,
+                  activebackground=CARD, activeforeground=DANGER, relief="flat",
+                  font=("Segoe UI", 10), bd=0, padx=10, pady=8, cursor="hand2"
+                  ).pack(side="right")
+
+        # status line
+        self.status = tk.Label(self, text="", bg=BG, fg=MUTED, font=("Segoe UI", 10),
+                               wraplength=420, justify="left", anchor="w")
+        self.status.pack(fill="x", padx=22, pady=(0, 16))
+
+        self.bind("<Return>", lambda e: self.on_drop())
+        self.var_e.focus_set()
+
+    def _toggle_show(self):
+        self.secret_e.configure(show="" if self.show_v.get() else "•")
+
+    def _set_status(self, text, color=MUTED):
+        self.status.configure(text=text, fg=color)
+
+    def _refresh_status(self):
+        def work():
+            try:
+                st = core.session_state(self.conf)
+            except Exception:
+                st = "login"
+            self.after(0, lambda: self._show_pill(st))
+        threading.Thread(target=work, daemon=True).start()
+
+    def _show_pill(self, st):
+        m = {"ready": ("🔓 unlocked", ACCENT), "apikey": ("🔑 api-key", ACCENT),
+             "locked": ("🔒 locked", MUTED), "login": ("⚠ needs login", DANGER)}
+        text, color = m.get(st, ("…", MUTED))
+        self.status_pill.configure(text=text, fg=color)
+
+    # ---------- actions ----------
+    def on_lock(self):
+        core.lock()
+        self._set_status("Vault locked; cached session cleared.", MUTED)
+        self._refresh_status()
+
+    def on_drop(self):
+        if self._busy:
+            return
+        var = self.var_e.get().strip()
+        if not core.valid_var(var):
+            self._set_status("Enter a valid ENV variable name (letters, digits, _).", DANGER)
+            return
+        secret = self.secret_e.get()
+        if not secret:
+            self._set_status("Paste a secret value first.", DANGER)
+            return
+        project = (self.proj_v.get().strip() or core.default_project(self.conf))
+        name = self.name_e.get().strip() or None
+        no_vault = not self.vault_v.get()
+
+        mp = None
+        if not no_vault:
+            state = core.session_state(self.conf)
+            if state == "login":
+                messagebox.showinfo(
+                    "One-time login",
+                    "Not logged in yet. Run this once in a terminal:\n\n    bw login\n\n"
+                    "(email + master password + 2FA). Then come back and Drop it.")
+                return
+            if state == "locked":
+                mp = simpledialog.askstring("Unlock vault", "Vault master password:",
+                                            show="•", parent=self)
+                if not mp:
+                    return
+
+        self._busy = True
+        self.drop_b.configure(state="disabled", text="Working…")
+        self._set_status("Working…", MUTED)
+
+        def work():
+            try:
+                res = core.drop(var, secret, project=project, name=name,
+                                no_vault=no_vault, master_password=mp, conf=self.conf)
+                self.after(0, lambda: self._done(res))
+            except core.NeedUnlock:
+                self.after(0, lambda: self._fail("Wrong or missing master password."))
+            except core.NeedLogin as e:
+                self.after(0, lambda: self._fail(str(e)))
+            except core.VwksError as e:
+                self.after(0, lambda: self._fail(str(e)))
+            except Exception as e:  # pragma: no cover
+                self.after(0, lambda: self._fail(f"Unexpected error: {e}"))
+
+        threading.Thread(target=work, daemon=True).start()
+
+    def _done(self, res):
+        self._busy = False
+        self.drop_b.configure(state="normal", text="Drop it  ⏎")
+        msg = f"✓ {res['env_action']} in {res['env_path']}"
+        if res["vault"]:
+            msg += f"\n✓ vault: {res['vault']} in “{res['folder']}”"
+        self._set_status(msg, ACCENT)
+        self.secret_e.delete(0, "end")
+        self.var_e.delete(0, "end")
+        self.show_v.set(0)
+        self._toggle_show()
+        # refresh project dropdown + pill
+        self.proj_e.configure(values=core.list_projects(core.env_dir(self.conf)))
+        self.var_e.focus_set()
+        self._refresh_status()
+
+    def _fail(self, text):
+        self._busy = False
+        self.drop_b.configure(state="normal", text="Drop it  ⏎")
+        self._set_status("✗ " + text, DANGER)
+        self._refresh_status()
+
+
+def main():
+    try:
+        app = App()
+    except tk.TclError as e:
+        raise SystemExit(f"VW Keystroke GUI needs a display: {e}")
+    app.mainloop()
+
+
+if __name__ == "__main__":
+    main()