Closes#18
All six Command::new call sites audited:
- bitwarden.rs (sh -c): shell string is a hardcoded literal; no user data.
- bitwarden.rs (bw unlock): all args hardcoded.
- bitwarden.rs (bw get): item_name and session passed as discrete .args() elements; no shell.
- nothooks/runner.rs (nu/sh/etc): interp and script path passed as discrete args; no shell.
- notstrap/repo.rs (git clone): url and dest passed as discrete .arg() calls; no shell.
- notfiles/tests/integration.rs: test harness with hardcoded args only.
Added SAFETY comments on the three sites that handle user-controlled config values.
Issue 12: pass bw unlock password via stdin (--passwordstdin) instead of
as a CLI arg, preventing it from appearing in /proc/<pid>/cmdline or ps output.
Issue 11: replace Nonce::default() (all-zero) with the first 12 bytes of the
16-byte random payload nonce. The key-nonce pair was already unique per message
(HKDF salt), but using an explicit non-zero nonce removes the latent risk of
accidental key reuse and makes the safety invariant self-documenting.
Closes#11, closes#12
- Replace AgeKeySource+retrieve() with IdentitySource+load() returning Box<dyn Identity>
- Rewrite bitwarden/file/prompt sources to implement new trait
- Add resolve_identities() public API with partial-success semantics
- Delete _legacy.rs and remove legacy re-exports from lib.rs
- Update integration tests to use new API
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
