nocwarden

A Bitwarden vault in the Noctalia bar, like the browser extension popup: a shield glyph in the bar, and a panel attached to it to unlock, search, copy username / password / TOTP, look at item details, add new items and move items to the trash.

It drives the official bw CLI, just like gowarden: bw from $PATH, else the CLI bundled with the Bitwarden desktop Flatpak (flatpak run --command=bw com.bitwarden.desktop), or whatever is set as bw command in the plugin settings.

Layout

Path	What
catalog.toml	Makes this repo a Noctalia plugin source
nocwarden/plugin.toml	Manifest: service, bar widget, vault panel, settings
nocwarden/service.luau	Runs every bw call (one at a time), caches the vault, clears the clipboard
nocwarden/bar.luau	Bar glyph; left click toggles the panel, right click locks
nocwarden/panel.luau	The vault panel: unlock, list, details, add
nocwarden/totp.luau	Local TOTP (SHA1, RFC 6238), so codes are instant
nocwarden/bw.sh	Runs bw with the session key and secrets kept out of argv
tests/totp_test.luau	TOTP tests against the RFC 6238 vectors

Install

noctalia msg plugins source add nocwarden git https://git.simoncor.net/simon/nocwarden.git
noctalia msg plugins enable simon/nocwarden   # clones the source

Pull in new commits with noctalia msg plugins update nocwarden. For development, point the source at a checkout instead (source add nocwarden path ~/Documents/nocwarden), Noctalia then hot-reloads .luau files on save.

Then add the nocwarden widget to the bar, or add "nocwarden" to a bar section with:

[widget.nocwarden]
type = "simon/nocwarden:bar"

bw login has to have happened once; the panel offers to run it in a terminal when it is not.

Usage

• Bar glyph: shield-check while unlocked, shield-lock while locked. Hover for account and item count.
• Left click opens the vault panel, right click locks the vault.
• Search matches names, usernames and URIs; the dropdown filters by favorites or folder. Enter copies the password of the top result.
• Each row has quick buttons to copy the username, password and TOTP. Click a row for all fields, a live TOTP code, reveal toggles and an open-website button.
• + adds a login or secure note (with a password generator), sync runs bw sync, lock runs bw lock.
• Delete in the item view needs a second click and moves the item to the trash (restorable for 30 days).

Copied secrets are cleared from the clipboard after Clear clipboard after seconds (default 30), unless something else was copied since.

Security

• The session key lives in $XDG_RUNTIME_DIR/gowarden/session (mode 0600, directory 0700, tmpfs wiped on logout), the same file gowarden uses, so unlocking or locking one does the same for the other. It reaches bw only through the BW_SESSION environment variable.
• The master password and new items are written to a one-off file in that directory, which bw.sh deletes as soon as it has opened it; the password goes to bw unlock --passwordenv, items to bw create item on stdin. Nothing secret is ever a command line argument.
• While unlocked, the decrypted vault is held in the Noctalia process memory (plugin state), like the browser extension holds it in the browser.
• Bitwarden's "master password re-prompt" flag is not enforced.

Development

Noctalia hot-reloads .luau files on save; plugin.toml changes need noctalia msg plugins disable simon/nocwarden && noctalia msg plugins enable simon/nocwarden.

noctalia plugins lint nocwarden          # cross-check settings
luau tests/totp_test.luau                # TOTP tests, needs the luau CLI
journalctl --user -u noctalia -f         # runtime errors
noctalia msg panel-toggle simon/nocwarden:vault
noctalia msg plugin simon/nocwarden:service all sync   # also: refresh, lock