Bitwarden Secrets Manager CLI

Use bws with secret-safe defaults. Install it when missing, authenticate without exposing the access token, inspect read-only state first, and make mutations only when the requested scope is exact.

Start every task

1. Run scripts/ensure-bws.sh. On native Windows without a POSIX shell, use the official PowerShell installer documented in references/cli-guide.md.
2. Run bws --version and bws --help when command behavior may vary by version.
3. Determine the server before authenticating. Bitwarden US is the default. Configure EU or self-hosted deployments only when the user identifies that environment.
4. Use an existing BWS_ACCESS_TOKEN environment variable. If none exists, ask the user to inject or export the token in their own secure environment.
5. Run scripts/check-auth.sh to perform a read-only authentication check that emits no vault data.

Read references/cli-guide.md for command syntax, output behavior, configuration, and troubleshooting. Use the live bws <command> --help output and linked official Bitwarden documentation as the final authority.