fix(install): install and authenticate Bitwarden CLI before chezmoi init

chezmoi templates call bitwarden for secrets (e.g. wakatime API key), but bw was only installed by the bootstrap chezmoiscript which runs after template evaluation. Install bitwarden-cli as a prerequisite and prompt for login if unauthenticated so chezmoi can resolve secrets on first apply.

Made-with: Cursor

Author: ChipWolf

install.ps1.tmpl

@@ -1,9 +1,6 @@
 {{- $repoURL := env "DOTFILES_REPO_URL" -}}
 {{- $releaseTag := env "DOTFILES_RELEASE_TAG" -}}
 # install.ps1 — Bootstrap chezmoi dotfiles on Windows.
-# Forks: update $repoUrl below to point at your fork.
-#
-# Render source: install.ps1.tmpl
 
 [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '', Justification = 'Install script uses Write-Host for coloured terminal output')]
 param()
@@ -72,13 +69,24 @@ if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
     }
 }
 
-# Ensure mise is available before chezmoi init (git credential helper uses `mise x -- gh`)
-if (-not (Get-Command mise -ErrorAction SilentlyContinue)) {
-    Write-Host "Installing mise..." -ForegroundColor Cyan
-    choco install mise -y --no-progress
+# Install remaining prerequisites that chezmoi init needs
+$prereqs = @()
+if (-not (Get-Command mise -ErrorAction SilentlyContinue)) { $prereqs += "mise" }
+if (-not (Get-Command bw -ErrorAction SilentlyContinue)) { $prereqs += "bitwarden-cli" }
+if ($prereqs.Count -gt 0) {
+    Write-Host "Installing $($prereqs -join ', ')..." -ForegroundColor Cyan
+    choco install @prereqs -y --no-progress
     $env:PATH = [System.Environment]::GetEnvironmentVariable("PATH", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("PATH", "User")
 }
 
+# Log in to Bitwarden if unauthenticated (chezmoi manages the session)
+$bwStatus = (bw status 2>$null | ConvertFrom-Json).status
+if ($bwStatus -eq "unauthenticated") {
+    Write-Host "Bitwarden vault is not logged in. Please log in:" -ForegroundColor Yellow
+    bw login
+    if ($LASTEXITCODE -ne 0) { throw "Bitwarden login failed." }
+}
+
 # Initialise and apply chezmoi dotfiles.
 # If the script is running from a local clone, use that as the source.
 # Otherwise (e.g. irm | iex), let chezmoi clone from GitHub into the default location.

install.sh.tmpl

@@ -3,9 +3,6 @@
 {{- $attestationRepo := env "DOTFILES_ATTESTATION_REPO" -}}
 {{- $releaseTag := env "DOTFILES_RELEASE_TAG" -}}
 #!/bin/sh
-# Forks: update repo_url below to point at your fork.
-#
-# Render source: install.sh.tmpl
 
 # -e: exit on error
 # -u: exit on unset variables
@@ -136,6 +133,27 @@ if ! chezmoi="$(command -v chezmoi)"; then
 	fi
 fi
 
+# Ensure Bitwarden CLI is available before chezmoi init (templates call bitwarden for secrets)
+if [ -z "${CODESPACES:-}" ]; then
+	if ! command -v bw >/dev/null 2>&1; then
+		if command -v brew >/dev/null 2>&1; then
+			echo "Installing Bitwarden CLI via Homebrew" >&2
+			brew install bitwarden-cli
+		else
+			echo "Bitwarden CLI (bw) is required but not installed and Homebrew is not available." >&2
+			echo "Install it manually: https://bitwarden.com/help/cli/" >&2
+			exit 1
+		fi
+	fi
+
+	# Log in to Bitwarden if unauthenticated (chezmoi manages the session)
+	bw_status="$(bw status 2>/dev/null | sed -n 's/.*"status":"\([^"]*\)".*/\1/p')"
+	if [ "$bw_status" = "unauthenticated" ]; then
+		echo "Bitwarden vault is not logged in. Please log in:" >&2
+		bw login </dev/tty
+	fi
+fi
+
 # POSIX way to get script's dir: https://stackoverflow.com/a/29834779/12156188
 script_dir="$(cd -P -- "$(dirname -- "$(command -v -- "$0")")" && pwd -P)"