fix(bitwarden): support slashes in custom fields

[jdx]

Summary

• preserve slashes after the first item/field delimiter in Bitwarden references
• cover slash-containing custom fields for both bw and rbw
• add vault-backed regression coverage and document the supported syntax

Root cause

Bitwarden references were split on every / and rejected unless they contained at most two segments. A reference such as item/A/B therefore failed before either Bitwarden backend ran, even though both backends can resolve a custom field named A/B.

The parser now treats only the first slash as the item/field delimiter and preserves the remainder as the exact custom field name.

Fixes the follow-up in discussion #689.

Validation

• cargo test -p fnox-core providers::bitwarden
• mise run build
• mise run test:cargo
• mise run lint
• mise run test:bats -- test/bitwarden.bats (vault-backed tests skipped without BW_SESSION)

The full Bats suite was also run; unrelated environment-dependent tests failed in keychain, GitHub lease, signal, and file-secret coverage.

AI-assisted — Tool: Codex; model: unavailable/GPT-5; version: unavailable.

---

Note

Low Risk
Localized parser change in the Bitwarden provider with regression tests; no auth or broader secret-handling changes.

Overview
Bitwarden reference parsing no longer rejects values with more than one / or splits on every slash. Only the first / separates item from field; everything after it is the field name (e.g. Database/API/Key → item Database, field API/Key). The previous Invalid secret reference format path for extra segments is removed.

get_secret uses a new parse_reference helper (split_once with default field password when no slash). bw custom-field JSON lookup and rbw --field args now receive the full slash-containing name.

Docs note that custom field names may contain /. Tests add unit coverage for parsing and slash fields, vault-backed Bats for item/API/Key, and drop the Bats case that expected failure on invalid/format/with/too/many/slashes.

^{Reviewed by Cursor Bugbot for commit 0904efd. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Bitwarden secret references now support custom field names containing /.
  • Custom field names remain case-sensitive when using the default backend.
• Tests
  • Added coverage for retrieving secrets from slash-containing custom fields.
• Documentation
  • Updated Bitwarden reference-format guidance to describe slash-containing field names.

[coderabbitai]

📝 Walkthrough

Walkthrough

Bitwarden references now split at the first /. Custom field names can contain additional slashes. Provider tests, integration fixtures, and documentation cover this format.

Changes

Bitwarden reference parsing

Layer / File(s)	Summary
Reference parser and provider tests crates/fnox-core/src/providers/bitwarden.rs	parse_reference defaults the field to password and preserves additional slashes. get_secret uses the parser. Tests cover API/Key.
Integration coverage and reference documentation test/bitwarden.bats, docs/providers/bitwarden.md	Fixtures and integration tests retrieve API/Key. Documentation states that custom field names may contain /.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• jdx/fnox#690: Introduced the Bitwarden custom-field reference behavior extended by this change.

Poem

A rabbit found a key in the night,
With slashes woven left and right.
The parser split once, then let fields roam,
API/Key safely carried home.
Hop, hop—Bitwarden reads it right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: Bitwarden now supports slashes in custom field names.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR updates Bitwarden reference parsing to split only at the first slash, preserving subsequent slashes in custom field names.

• Adds shared first-delimiter parsing for both bw and rbw.
• Adds unit and vault-backed regression coverage for slash-containing custom fields.
• Documents slash support in Bitwarden custom field names.

Confidence Score: 5/5

The PR appears safe to merge, with the parser, backend argument handling, regression test, and documentation aligned.

The first slash remains the item/field delimiter while the complete remainder is passed as the custom field name, preserving existing references and enabling the intended slash-containing fields.

Important Files Changed

Filename	Overview
crates/fnox-core/src/providers/bitwarden.rs	Replaces all-segment splitting with first-slash parsing and adds focused coverage for shared parsing and both backend command paths.
test/bitwarden.bats	Extends the test vault fixture and verifies an end-to-end lookup of a custom field containing a slash.
docs/providers/bitwarden.md	Documents that Bitwarden custom field names may contain slashes.

_{Reviews (1): Last reviewed commit: "fix(bitwarden): support slashes in custo..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/bitwarden.bats`:
- Around line 218-237: Update the test setup after item_id is assigned in "fnox
get retrieves custom field containing a slash" to register deletion through the
test teardown or exit-trap mechanism, ensuring delete_test_bw_item runs even
when run, assert_success, or assert_output fails; remove the success-only
cleanup call.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d20106d7-bfa6-401e-89b2-2b372900b806

📥 Commits

Reviewing files that changed from the base of the PR and between 3e51099 and 0904efd.

📒 Files selected for processing (3)

• crates/fnox-core/src/providers/bitwarden.rs
• docs/providers/bitwarden.md
• test/bitwarden.bats

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Clean up the test item after test failures.

The test deletes the Bitwarden item only after run, assert_success, and assert_output pass. If any step fails, the generated item remains in the vault and can pollute later test runs. Register cleanup as soon as item_id is available through the test teardown or exit-trap path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/bitwarden.bats` around lines 218 - 237, Update the test setup after
item_id is assigned in "fnox get retrieves custom field containing a slash" to
register deletion through the test teardown or exit-trap mechanism, ensuring
delete_test_bw_item runs even when run, assert_success, or assert_output fails;
remove the success-only cleanup call.

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
schema	▁▁▁▁▁▁▁▁▃▃▇███	7,117,874 → 7,116,598	-0.02%	3.07 → 3.05ms	-0.42%
usage	▁▁▁▁▁▁▁▁▁▁▇███	10,912,364 → 10,911,385	-0.01%	3.30 → 3.38ms	+2.42%

No instruction-count regression above 1.25%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{0904efdc082f vs 3e51099a619a · measured on the runner, not pushed to the history.}