Bitwarden CLI for agentic workflows

Unlock the vault once on a workstation, persist the CLI session locally, and teach agents to restore it via an entry script — without printing secrets into chat or git.

Operator unlocks once, machine stores BW_SESSION, agent entry script restores, CLI runs
Architecture context

Harness-neutral architecture (machine-local layer).

Sibling

gcloud CLI for agentic workflows.

When to enable

Choose this when agents call bw list / bw get often on one encrypted workstation and you accept local storage of BW_SESSION.

Do not enable by default for shared CI, org-wide laptops without disk encryption, or as a substitute for Bitwarden Secrets Manager in product code.

What persists

| Material | Role |

BW_CLIENTID / BW_CLIENTSECRET

bw login --apikey — identity for the CLI account (not vault decrypt)

BW_SESSION

Vault decrypt key from bw unlock — valid until bw lock / bw logout (no built-in CLI timeout)

Optional DPAPI blob

CurrentUser-protected copy of the session for new shells (Windows)

Pattern (portable)

The forkable write-up lives in the shared reference:

One-liner in always-on rules:

  • user.md (Optional workstation patterns)

Harness example keys:

Stamp on the machine (never in forkable templates):

BITWARDEN_SESSION_PERSIST = enabled
BITWARDEN_AGENT_ENTRY = ensure_bw_unlocked.ps1

Document script paths and overlay names in $CODE_ROOT/machine.md and $LOCAL_RULES_DIR (see harness-neutral).

Agent procedure

  1. Dot-source the entry script (path from $MACHINE / harness — typically under the user profile).

  2. Run bw status and report only status + userEmail (JSON).

  3. Then bw list / bw get / bw sync as needed.

  4. Never print, log, or Read BW_SESSION, BW_CLIENTSECRET, bw-apikey.local.ps1, or DPAPI session files into chat or git.

Reference implementation

Scripts and skill body live in a personal overlay until upstreamed into the org catalog:

Install once by copying scripts from that skill’s scripts/ directory into the user profile (exact list is in SKILL.md). Prefer file links (blob/main/…​ or tree/main/…​) — not #L… line anchors, which break when files move.

Org catalog note

dev-centr/agent-rules does not list bitwarden-unlock in skills/CATALOG.md until the skill is promoted; the optional pattern file above is the portable contract.

Related secrets distribution

Pulling vault custom fields into local/hosting env (separate from session persist):

Safety checklist

  • Disk encryption on

  • Session persist documented only in $HARNESS / $MACHINE / local IDE overlays

  • Agents never dump item secrets or session strings

  • Clear path: bw lock (and clear local session store when using the reference scripts)