I updated the TypeSafe key at the vendor on September 20th. Pulled the new value from Bitwarden, pushed it to the box over SSH with the right permissions. Fine.
Then I had to do it again.
Same key. Same box. Re-deriving the same ssh/umask/heredoc one-liner from memory each time. Twice in one day was enough to know the manual version was already a liability.
The script for this was written the same day. It’s main job is that the secret never appears on screen. The secret leaves the Bitwarden subprocess and goes straight into the SSH channel from stdin, received on the remote side by cat >. The value never touches a Mac file or your terminal along the way.
The verification step is the part that actually changes what kind of tool this is. Manually, you’d confirm by looking at the file, which means cat, which means the secret is now in your terminal scrollback. The script re-fetches the value from Bitwarden and hashes it locally with SHA-256. It hashes the value from the remote file the same way. Six characters of each must match. A match means the value arrived correctly. No display required.
That’s a different kind of correct than the manual version. The verification doesn’t require you to look at the thing you’re not supposed to be printing, and that’s the actual change.
The push needs BW_SESSION, an active Bitwarden session, so it stays manual at the human layer. Scripts on the fleet boxes read env files fresh each run, which means the credential is live the moment this completes. But the push itself never runs autonomously. Claude can call it, but it never runs the Bitwarden fetch.
You call it with the one-liner and it handles the rest. It maps the Mac home path to the box’s home automatically so passing the env file works the way you’d expect, and the comment at the top says: never bash -x this.
I could have built this after the first rotation. Something happening one time doesn’t justify automation. I could have waited until after at least a third occurrence, which is what I usually do. However, I knew rotating this credential is something that will happen multiple times. Two rotations were all I needed to make the call.