dsh-bitwarden

A recurring friction in DSH sessions is the constant need to remind the model where credentials live. Every fresh session defaults to asking you for a password or API key instead of checking a vault on its own. dsh-bitwarden removes that step entirely: once installed, DSH injects a concise system-prompt section that instructs the model to consult a Bitwarden or Vaultwarden vault before asking the user for any account, password, API key, or token.

The plugin talks directly to the self-hosted server's REST API (prelogin, connect/token, sync) and does not require the bw CLI or any external runtime dependency beyond an optional hash-wasm module for Argon2id KDF. Three global tools cover the full credential-lookup workflow: bitwarden_find searches entries without exposing secrets, bitwarden_get retrieves a password, username, TOTP code, notes, or custom field, and bitwarden_status reports configuration, connectivity, and unlock state. Sensitive fields such as the master password and API key are filled once in the built-in settings card, marked as secret, and are never sent back to the browser after saving.

On the security side, the master password, derived user key, and decrypted entries reside only in memory; nothing is written to disk or captured in logs. The prompt explicitly discourages the model from echoing plaintext credentials or writing them to files. Accounts protected by two-factor authentication can use API-key login to bypass the challenge while still relying on the master password to decrypt the vault. This plugin is a natural fit for developers and SREs who self-host Bitwarden or Vaultwarden and routinely handle deployment scripts, database connection strings, CI tokens, and other sensitive credentials inside DSH sessions.