unlock

Unlock Skill

Load project secrets from Bitwarden Secrets Manager into the current environment using the bws CLI. Fully stateless — no vault unlock or session tokens required.

Configuration

Item	Value
BWS project ID	$BWS_PROJECT_ID env var, or 5022ea9c-e711-4f4e-bf5f-b3df0181a41d (default project ID for Troy's vault — override via BWS_PROJECT_ID)
Access token env var	BWS_ACCESS_TOKEN (deprecated fallback — TROY, for older setups that still export it)
bws install docs	https://bitwarden.com/help/secrets-manager-cli/

Implementation

When the user invokes /unlock, follow these steps:

Step 1: Detect platform and locate bws

Windows (win32):

where.exe bws 2>$null || (Test-Path "$env:USERPROFILE\bin\bws.exe")

Linux/macOS:

command -v bws || test -x "$HOME/bin/bws"

If not found, tell the user to install bws from https://bitwarden.com/help/secrets-manager-cli/ and stop.

Step 2: Get access token

The access token is stored in the BWS_ACCESS_TOKEN environment variable. TROY is a deprecated fallback name, retained only so an existing setup that still exports TROY keeps working — new setups should use BWS_ACCESS_TOKEN.

Windows — check process env first, then Windows user env, then fall back to the deprecated name:

$token = $env:BWS_ACCESS_TOKEN
if (-not $token) { $token = [System.Environment]::GetEnvironmentVariable('BWS_ACCESS_TOKEN', 'User') }
if (-not $token) { $token = $env:TROY }  # deprecated fallback
if (-not $token) { $token = [System.Environment]::GetEnvironmentVariable('TROY', 'User') }  # deprecated fallback

Linux/macOS — check process env, then the deprecated fallback:

TOKEN="${BWS_ACCESS_TOKEN:-$TROY}"  # TROY: deprecated fallback name

If empty, tell the user:

• Windows: Set via [System.Environment]::SetEnvironmentVariable('BWS_ACCESS_TOKEN', 'your-token', 'User')
• Linux/macOS: Add export BWS_ACCESS_TOKEN="your-token" to ~/.bashrc or ~/.zshrc