eleven / messenger Public

deploy: make the Bitwarden unlock prompt visible (own read + --passwordenv) (#1326)

Inside $(…) bw's inquirer prompt writes to the captured stdout, so it
sat invisible until a stray Enter forced a redraw. Prompt ourselves on
stderr and hand the password to bw via --passwordenv.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 3 months ago c42e0e2afbfcb848406b1458433e2252abc61a02 parent 4edbfe3

1 file changed, +14 −4

deploy/release-server.sh +14 −4

diff --git a/deploy/release-server.sh b/deploy/release-server.sh

index 6df6e05..abb36a2 100755

--- a/deploy/release-server.sh

+++ b/deploy/release-server.sh

@@ -112,11 +112,21 @@ case "${1:-}" in publish|promote)

# session): unlock — prompts for the master password on the tty — then

# read again.

echo "release-server: unlocking Bitwarden to read the signing key…" >&2

- # stdin pinned to the tty: without it bw's Node prompt sits invisible

- # until a stray Enter nudges it (inquirer inherits whatever stdin state

- # the pipeline left behind — the "I had to press Enter" papercut).

- BW_SESSION="$(bw unlock --raw </dev/tty)" && export BW_SESSION || {

+ # We prompt, not bw: inside $(…) bw's inquirer prompt goes to the

+ # captured stdout, so it sits invisible until a stray Enter forces a

+ # redraw (the "I had to press Enter" papercut — the earlier /dev/tty

+ # stdin pin didn't fix it because the prompt is an OUTPUT problem).

+ # A shell read on stderr is always visible; --passwordenv skips

+ # inquirer entirely and the password never touches disk or argv.

+ printf "release-server: Bitwarden master password (typing is hidden): " >&2

+ IFS= read -rs LCHAT_BW_PASSWORD </dev/tty || { # set -e: die with a hint, not silently

+ echo >&2; echo "release-server: no tty to prompt on — run 'bw unlock' first or set LCHAT_RELEASE_KEY" >&2; exit 1; }

+ echo >&2

+ BW_SESSION="$(LCHAT_BW_PASSWORD="$LCHAT_BW_PASSWORD" bw unlock --raw --passwordenv LCHAT_BW_PASSWORD)" \

+ && export BW_SESSION || {

+ unset LCHAT_BW_PASSWORD

echo "release-server: Bitwarden unlock failed — unlock it (or set LCHAT_RELEASE_KEY), then retry" >&2; exit 1; }

+ unset LCHAT_BW_PASSWORD

_t0="$(date +%s)"

LCHAT_RELEASE_KEY="$(bw_key)"

[ -n "$LCHAT_RELEASE_KEY" ] || { bw_stalled "$_t0" && exit 1 || true; }