⚡ VaultSweep

Note

This project was created in its entirety by an AI coding assistant (minus some initial basic project scaffolding). See the AI Development section at the bottom of this document for details.

VaultSweep is a robust, locally-running command-line utility built in Go (using only the standard library) designed to operate against the local bw serve REST API from the Bitwarden CLI.

VaultSweep helps you declutter and organize your vault by automatically identifying and resolving two common issues:

1. Empty Logins: Login items that contain no password and no passkeys.
2. Duplicate Logins: Strictly identical credentials (same username & password) that vary only by hostnames within the same base domain (e.g., login.example.com, api.example.com).

---

🛠️ Prerequisites

VaultSweep operates directly against the local REST API server exposed by the Bitwarden CLI.

1. Log in and unlock your vault in your terminal:

   bw login
   bw unlock
   

2. Set the session environment variable and start the local server (defaults to port 8087):

   export BW_SESSION="your_session_key"
   bw serve
   

---

🚀 Execution

Since the project is packaged with Nix, you can compile and execute it instantly without installing Go:

nix run

To connect to a custom port or API URL, use the -url flag:

nix run . -- -url http://localhost:9000

---

📋 Features & Scenarios

🔎 1. Archiving Passwordless / Passkeyless Logins

VaultSweep scans your active vault for login items (type == 1) that have:

• An empty or null password (""), AND
• No registered passkeys (FIDO2 credentials) in their fido2Credentials array.

If empty entries are found, VaultSweep presents them in a detailed list and prompts you for permission to archive them. Archiving safely hides these obsolete entries from standard vault searches and autofill suggestions while preserving their history.

👥 2. Strict Duplicate Detection & Merging

VaultSweep automatically detects identical login credentials spread across different subdomains.

• Strict Match Criteria: Items are only considered duplicates if they share the exact same username and password, and their primary URLs belong to the exact same base domain (e.g., test.example.co.uk and login.example.co.uk share example.co.uk).
• Visual Target Selection: It displays the full details of all duplicates in a set. It automatically proposes the entry with the shortest name (usually the top-most domain) as the proposed target, but allows you to pick any entry as the merge target.
• Lossless Data Merging:
  • All unique URLs from duplicate source items are merged into the target item's uris list.
  • All notes from duplicate source items are appended to the target item's notes under clear source headers (e.g. [subdomain notes]: ...) so no backup codes or recovery keys are lost.
• Archive Clean Up: Once the target entry is updated in place via PUT /object/item/{id}, all duplicate source items are automatically archived via POST /archive/item/{id} to prevent vault clutter.

---

📺 Sample Terminal Output

================================================================================
       ⚡  VaultSweep — Bitwarden Passwordless Vault Cleaner  ⚡
================================================================================

[*] Connecting to Bitwarden local REST API...
[✓] Successfully connected to API!
[*] Vault Status: unlocked

[*] Syncing vault at startup... [✓] Sync complete

=== 🔎 Scanning Vault for Passwordless Login Items ===
Looking for Login items with no password AND no passkey/FIDO2 credentials...

[!] Found 2 empty login item(s) in active vault:
--------------------------------------------------------------------------------
  1. Name: 'Old Jenkins Instance'       | User: buildbot             | ID: 02272326...
  2. Name: 'Legacy FTP Credentials'     | User: (no username)        | ID: d856b440...
--------------------------------------------------------------------------------

❓ Would you like to ARCHIVE these 2 item(s)? [y/N]: y

🚀 Archiving items...
   Archiving 'Old Jenkins Instance'... ✓ Success
   Archiving 'Legacy FTP Credentials'... ✓ Success

[✓] Completed. Archived 2 of 2 empty item(s).

=== 👥 Scanning Vault for Duplicate Login Items ===
Looking for duplicate logins sharing the exact same username/password but varying by host/subdomain...

[!] Found 1 set(s) of duplicates in your vault.

--- Group 1 of 1: Domain 'github.com' (User: seabat11) ---
  1. Name: 'github.com' (Proposed Target)
     ID:    9fce50fe-d2e9-43c6-a9ba-9164480f5bfb
     URLs:  https://github.com
     Notes: Main personal developer keys

  2. Name: 'gist.github.com'
     ID:    2fa8fdaf-043f-4a42-ab71-6fbb94b00284
     URLs:  https://gist.github.com
     Notes: Gist backup recovery phrases: 123-456

❓ Choose the MERGE TARGET (1-2, 'skip' to ignore, or press Enter for proposed target [1]): 1

❓ Are you sure you want to merge duplicates into 'github.com'? [Y/n]: y
🚀 Merging duplicates into 'github.com'...
   Updating target entry 'github.com'... ✓ Success
   Archiving duplicate 'gist.github.com'... ✓ Success

[✓] Completed. Merged 1 duplicate set(s).

[*] Syncing changes at shutdown... [✓] Final sync complete

================================================================================
💚 Thank you for using VaultSweep! Keep your vault safe and clean. 

---

🤖 AI Development

This project was created in its entirety by Antigravity, an AI coding assistant. The agent wrote all implementation and test code, and only minimal human code review has been conducted. The tool was manually tested and only the standard library was used to reduce external dependency risk. Proceed at your own risk while using the tool.