bitwarden

Bitwarden vault: the bar shows whether it is locked; the dropdown logs in, unlocks, searches the vault and copies an item's username, password or one-time code.

The vault lives in lys-secrets (dev.stubbe.lys.Vault1), the one process holding its keys; the shell shows it and copies from it. The idle lock and the sync interval are lys-secrets' settings (--vault-lock-after, --vault-sync-interval). Copied secrets are marked so clipboard managers, the shell's own history included, do not keep them.

The launcher's vault mode (lys-shell launcher -show vault) searches the open vault from anywhere: Enter copies an item's password (or its first field), Shift+Enter lists its fields to pick one. A locked vault asks for the master password in the launcher's masked input, and a protected item asks again before a secret is copied.

The dropdown's generator (its header's shuffle button) lists the generator-passwords and generator-passphrases presets; picking one copies a new password or passphrase, made in the shell, as a secret. Passphrases draw from the EFF large wordlist (CC BY 3.0 US, by the Electronic Frontier Foundation).

The dropdown's Sends (its header's paper plane) lists the vault's Bitwarden Sends, deletes them, and creates a text Send deleted after an hour, a day, a week or 31 days, optionally limited in opens and behind a password; its link, which carries the Send's key, is copied as a secret.

Add it to your layout with bitwarden:

bar:
  layout:
    - monitor: "*"
      right: [bitwarden]

General

Field	Type	Default	Description
server	BitwardenServer	"bitwarden.com"	Server the login form logs in to. A logged-in account keeps the server it logged in to.
email	string	""	Email the login form starts with.
lock-with-session	bool	true	Lock the vault when the session locks.
unlock-with-session	bool	false	Unlock a locked vault with the password that unlocks the lock screen, once per unlock and never retried. Only useful when the master password is the login password; each wrong guess costs lys-secrets a full key derivation.
clipboard-clear	u32	30	Clear a copied secret from the clipboard after this many seconds, unless something else was copied since. 0 leaves it there.
network-folder	string	""	Vault folder whose logins answer NetworkManager's requests for Wi-Fi, 802.1X and VPN secrets while the vault is open, before the shell asks. The one login named exactly like the connection profile answers: its password for the password, PSK or secret, its username for the username, and a custom field of a key's name for that key (pin, domain, private-key-password). A login behind the master-password reprompt never answers, and secrets NetworkManager rejected are asked for again. Empty answers nothing from the vault. A password (and username) typed into the shell's prompt is offered for saving here, as a login named like the profile, once the connection came up with it.
portal-folder	string	""	Vault folder apps' Secret portal master secrets are kept in: the key each sandboxed app's saved passwords are encrypted with, which then survives a reinstall and is the same on every computer. Each app's key is put there on its first use with the vault open, after you allow it; the keyring keeps a copy, so the app still opens while the vault is locked. Empty keeps the keys in the keyring only.
format	string	"{{ count }}"	Format string for the label.
icon-locked	string	"ld-lock-symbolic"	Icon while the vault is locked or logged out.
icon-unlocked	string	"ld-lock-open-symbolic"	Icon while the vault is open.
border-show	bool	false	Display border around button.
icon-show	bool	true	Display module icon.
label-show	bool	false	Display label.
label-max-length	u32	0	Max label characters before truncation with ellipsis. Set to 0 to disable.

More about format

Placeholders

• {{ count }} - Number of items in the open vault (empty while locked)

Examples

• "{{ count }}" - "142"

Colors

Field	Type	Default	Description
border-color	ColorValue	"blue"	Border color token.
icon-color	ColorValue	"auto"	Icon foreground color. Auto selects based on variant for contrast.
icon-bg-color	ColorValue	"blue"	Icon container background color token.
label-color	ColorValue	"fg-default"	Label text color token.
button-bg-color	ColorValue	"bg-surface-elevated"	Button background color token.

Click actions

Field	Type	Default	Description
left-click	ClickAction	"dropdown:bitwarden"	Action on left click. Defaults to opening the vault dropdown.
right-click	ClickAction	""	Action on right click.
middle-click	ClickAction	""	Action on middle click.
scroll-up	ClickAction	""	Action on scroll up.
scroll-down	ClickAction	""	Action on scroll down.

Generator

Field	Type	Default	Description
generator-passwords	array of BitwardenPasswordPreset	[...]	Password presets the dropdown's generator offers. Generating copies a new password as a secret, cleared after clipboard-clear.
generator-passphrases	array of BitwardenPassphrasePreset	[...]	Passphrase presets the dropdown's generator offers, of words from the EFF large wordlist. Generating copies a new passphrase as a secret, cleared after clipboard-clear.

Default configuration

modules:
  bitwarden:
    server: bitwarden.com
    email: ""
    lock-with-session: true
    unlock-with-session: false
    clipboard-clear: 30
    network-folder: ""
    portal-folder: ""
    generator-passwords:
      - name: Password
        length: 20
        charsets:
          - lowercase
          - uppercase
          - digits
          - symbols
        avoid-ambiguous: false
    generator-passphrases:
      - name: Passphrase
        words: 6
        separator: '-'
        capitalize: true
        number: true
    format: '{{ count }}'
    icon-locked: ld-lock-symbolic
    icon-unlocked: ld-lock-open-symbolic
    border-show: false
    border-color: blue
    icon-show: true
    icon-color: auto
    icon-bg-color: blue
    label-show: false
    label-color: fg-default
    label-max-length: 0
    button-bg-color: bg-surface-elevated
    left-click: dropdown:bitwarden
    right-click: ""
    middle-click: ""
    scroll-up: ""
    scroll-down: ""