init: workspace opencode sync

.gitignore

@@ -0,0 +1,6 @@
+*.log
+__pycache__/
+*.pyc
+.DS_Store
+node_modules/
+.env

bw-auth.ps1

@@ -0,0 +1,74 @@
+param(
+    [switch]$Store,
+    [switch]$UnlockOnly,
+    [string]$ClientId,
+    [string]$ClientSecret,
+    [string]$Password
+)
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Security
+
+$Dir   = Join-Path $env:LOCALAPPDATA 'bw-cli'
+$CredFile = Join-Path $Dir 'creds.bin'
+$SessionFile = Join-Path $Dir 'session.txt'
+$LogFile = Join-Path $Dir 'auth.log'
+
+function Write-Log($msg) {
+    ("{0} {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $msg) | Add-Content -Path $LogFile
+}
+
+function Protect-String([string]$plain) {
+    [System.Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($plain), $null, 'CurrentUser')
+}
+function Unprotect-String([byte[]]$blob) {
+    [Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($blob, $null, 'CurrentUser'))
+}
+
+if ($Store) {
+    if (-not $ClientId)  { $ClientId  = Read-Host 'BW_CLIENTID' }
+    if (-not $ClientSecret) { $ClientSecret = Read-Host 'BW_CLIENTSECRET' -AsSecureString; $ClientSecret = [Net.NetworkCredential]::new('', $ClientSecret).Password }
+    if (-not $Password)  { $Password  = Read-Host 'Master password' -AsSecureString; $Password = [Net.NetworkCredential]::new('', $Password).Password }
+    New-Item -ItemType Directory -Path $Dir -Force | Out-Null
+    $payload = [PSCustomObject]@{ clientId = $ClientId; clientSecret = $ClientSecret; password = $Password } | ConvertTo-Json -Compress
+    [IO.File]::WriteAllBytes($CredFile, (Protect-String $payload))
+    Write-Log "Credential stored (DPAPI, user scope)"
+    "OK: credential tersimpan DPAPI di $CredFile"
+    exit 0
+}
+
+if (-not (Test-Path $CredFile)) {
+    Write-Error 'Credential file tidak ada. Jalankan dulu:  ./bw-auth.ps1 -Store'
+}
+$cred = Unprotect-String ([IO.File]::ReadAllBytes($CredFile)) | ConvertFrom-Json
+$env:BW_CLIENTID     = $cred.clientId
+$env:BW_CLIENTSECRET = $cred.clientSecret
+$env:BW_PASSWORD     = $cred.password
+
+# Ensure server config (may error if already logged in — harmless)
+try { bw config server https://vault.s.dimanaaja.biz.id 2>$null | Out-Null } catch {}
+Write-Log 'Server config ensured'
+
+# Login if not authenticated
+$status = bw status 2>&1 | Out-String | ConvertFrom-Json
+if ($status.status -eq 'unauthenticated') {
+    bw login --apikey 2>&1 | Out-Null
+    Write-Log 'Logged in via API key'
+    $status = bw status 2>&1 | Out-String | ConvertFrom-Json
+}
+
+if ($status.status -eq 'locked' -or $UnlockOnly) {
+    $session = (bw unlock --raw --passwordenv BW_PASSWORD 2>$null)
+    if (-not $session) { Write-Error 'Unlock gagal — cek master password / creds' }
+    Set-Content -Path $SessionFile -Value $session -NoNewline
+    $env:BW_SESSION = $session
+    Write-Log 'Unlocked; session cached'
+    $status = bw status 2>&1 | Out-String | ConvertFrom-Json
+}
+
+$session = Get-Content $SessionFile -Raw
+# Inject into tmux session if running
+if (tmux ls 2>$null | Select-String 'bw-session') {
+    tmux send-keys -t bw-session "`$env:BW_SESSION='$session'; clear" Enter
+    Write-Log 'BW_SESSION injected into tmux bw-session'
+}
+"status=$($status.status) user=$($status.userEmail) server=$($status.serverUrl)"

bw-run.ps1

@@ -0,0 +1,15 @@
+param(
+    [Parameter(Mandatory = $true, Position = 0)]
+    [string]$Command
+)
+$ErrorActionPreference = 'Stop'
+
+$SessionFile = Join-Path (Join-Path $env:LOCALAPPDATA 'bw-cli') 'session.txt'
+if (Test-Path $SessionFile) {
+    $env:BW_SESSION = (Get-Content $SessionFile -Raw).Trim()
+}
+if (-not $env:BW_SESSION) {
+    Write-Error 'Session tidak ada. Jalankan ./bw-auth.ps1 dulu'
+}
+
+bw $Command.Split(' ') | Out-String