Merge remote-tracking branch 'gitea/master' into sidecar-app-store

src/servers/hono.ts

@@ -22,6 +22,7 @@ import { taskLogsRouter } from './api/task-logs/task-logs';
 import { router as fileBrowserRouter } from './api/file-browser/router';
 import { musicRouter } from './api/music/router';
 import { vaultRouter } from './api/vault/router';
+import { publicVaultRouter, VAULT_ONLY_PREFIXES, isBitwardenClient } from './api/vault/public-router';
 import { agentHandoffRouter } from './api/agent-handoff/router';
 import { slskdRouter } from './api/slskd/router';
 import { headscaleRouter } from './api/headscale/router';
@@ -103,6 +104,27 @@ honoServer.route('/api/waitlist', waitlistRouter);
 // gating still applies via originScopeMiddleware above (OFFICER_VAULT_ORIGIN → /api/vault). The
 // notifications WebSocket is upgraded at the serve level (server.tsx).
 honoServer.route('/api/vault', vaultRouter);
+
+// The same Vaultwarden, with NO Officer authentication, so the Bitwarden browser extension can point at
+// this host instead of at a second public hostname for Vaultwarden. Deliberately its own mount rather
+// than a mode of the router above: that one requires an Officer session and swaps the caller's
+// Authorization header for a server-held token, and blending the two would put an unauthenticated branch
+// inside the authenticated path. Temporary — see public-router.ts for what replaces it and why leaving it
+// open is not a new exposure.
+honoServer.route('/vaultwarden', publicVaultRouter);
+
+// …and at the ROOT, so the extension can be pointed at the bare Officer URL with no path at all.
+//
+// Registered BEFORE `/api` is mounted, because hono matches in registration order and this has to win
+// for a Bitwarden client. It is deliberately narrow: the four prefixes below belong to Vaultwarden and
+// to nothing else here, and `/api/*` is diverted ONLY when the request carries a Bitwarden client
+// header. An ordinary Officer request never matches, so nothing that worked before changes.
+for (const prefix of VAULT_ONLY_PREFIXES) honoServer.route(prefix, publicVaultRouter);
+
+honoServer.use('/api/*', async (ctx, next) => {
+  if (!isBitwardenClient(ctx.req.raw.headers)) return next();
+  return publicVaultRouter.fetch(ctx.req.raw, ctx.env);
+});
 honoServer.get('/api/integrations/google/callback', googleCallbackHandler);
 
 // Agent-to-agent handoff — mounted TOP-LEVEL for the same reason the vault is: the caller is a Claude