fix(colibri-vault): harden bw interaction — server-match fail-closed + serialize + note-key validation #100

Merged

clawdie merged 1 commit from fix/colibri-vault-bw-hardening into main

2026-06-20 09:00:53 +02:00

clawdie commented

2026-06-20 08:30:30 +02:00

Owner

What

Hardens the colibri-vault crate's bw interaction (the autonomous daemon provisioning path), bringing it to parity with — and slightly ahead of — the clawdie-vault-fetch shell helper (#69). Found during review of #69/#94.

Changes

BW_SERVER server-match, fail-closed. Previously bw config server was ?-propagated, so it hard-failed on the 2nd+ provision (bw stays authenticated between calls → "logout required"). Now it tolerates that refusal only if the already-configured server matches the expected endpoint; otherwise fails closed with a new VaultError::ServerMismatch. This both fixes repeat provisioning and stops a stale login from fetching against the wrong Bitwarden host — the same guard #69 added to the shell helper, which the daemon path lacked.
Serialize provisions (closes #95). bw keeps process-global state (one configured server + session per process). Concurrent jailed spawns → concurrent provision() → could tear down each other's session mid-fetch. Wrapped the whole login→unlock→fetch→lock lifecycle in a process-wide tokio::sync::Mutex.
Validate secure-note keys. Login items already ran validate_key; the secure-note path wrote raw KEY=VALUE. Now note keys are validated identically (no unchecked .env injection from a note).

Tests

cargo build -p colibri-vault ✅, cargo test -p colibri-vault ✅ (7 pass, incl. new server_config_locked_detection_matches_bw_cli_text and vault_lock_serializes), cargo fmt --check clean.
Built/tested on Linux (domedog) — the crate is OS-clean.

Mirrors #69 (shell helper) into the Rust crate.
Closes #95.
Orthogonal to #92 (path canonicalization, daemon.rs side) and #98/#70 (pkg naming).

🤖 Generated with Claude Code

## What Hardens the `colibri-vault` crate's `bw` interaction (the autonomous daemon provisioning path), bringing it to parity with — and slightly ahead of — the `clawdie-vault-fetch` shell helper (#69). Found during review of #69/#94. ## Changes 1. **`BW_SERVER` server-match, fail-closed.** Previously `bw config server` was `?`-propagated, so it hard-failed on the **2nd+ provision** (bw stays authenticated between calls → "logout required"). Now it tolerates that refusal **only if** the already-configured server matches the expected endpoint; otherwise fails closed with a new `VaultError::ServerMismatch`. This both fixes repeat provisioning *and* stops a stale login from fetching against the wrong Bitwarden host — the same guard #69 added to the shell helper, which the daemon path lacked. 2. **Serialize provisions (closes #95).** `bw` keeps process-global state (one configured server + session per process). Concurrent jailed spawns → concurrent `provision()` → could tear down each other's session mid-fetch. Wrapped the whole `login→unlock→fetch→lock` lifecycle in a process-wide `tokio::sync::Mutex`. 3. **Validate secure-note keys.** Login items already ran `validate_key`; the secure-note path wrote raw `KEY=VALUE`. Now note keys are validated identically (no unchecked `.env` injection from a note). ## Tests - `cargo build -p colibri-vault` ✅, `cargo test -p colibri-vault` ✅ (7 pass, incl. new `server_config_locked_detection_matches_bw_cli_text` and `vault_lock_serializes`), `cargo fmt --check` clean. - Built/tested on Linux (domedog) — the crate is OS-clean. ## Related - Mirrors #69 (shell helper) into the Rust crate. - Closes #95. - Orthogonal to #92 (path canonicalization, daemon.rs side) and #98/#70 (pkg naming). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

clawdie added 1 commit 2026-06-20 08:30:32 +02:00

fix(colibri-vault): harden bw interaction — server-match fail-closed + serialize + validate note keys

CI / rust (pull_request) Has been cancelled

Details

CI / markdown (pull_request) Has been cancelled

Details

37b00525ca

Bring the daemon's provisioning path to parity with (and ahead of) the
clawdie-vault-fetch shell helper (#69):

- BW_SERVER: tolerate 'logout required/already configured' ONLY when the
  already-configured server matches the expected endpoint; else fail closed
  (new VaultError::ServerMismatch). Fixes repeat-provision failure AND prevents
  a stale login fetching from the wrong Bitwarden host.
- Serialize the whole login→unlock→fetch→lock via a process-wide async Mutex —
  bw keeps process-global state, so concurrent provisions could race (closes #95).
- Validate secure-note KEYs with validate_key too (login items were already
  validated; notes wrote raw KEY=VALUE).

Tests: cargo build/test -p colibri-vault (7 pass), cargo fmt --check clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>