feat: wire bitwarden cache options

secretstore/manifest_open.go

@@ -21,6 +21,7 @@ type OpenFromManifestOptions struct {
 	KWalletFolder         string
 	BitwardenCommand      string
 	BitwardenDebug        bool
+	DisableBitwardenCache bool
 	Shell                 string
 	ManifestLoader        ManifestLoader
 	ExecutableResolver    ExecutableResolver
@@ -40,6 +41,7 @@ func OpenFromManifest(options OpenFromManifestOptions) (Store, error) {
 		KWalletFolder:         options.KWalletFolder,
 		BitwardenCommand:      strings.TrimSpace(options.BitwardenCommand),
 		BitwardenDebug:        options.BitwardenDebug,
+		DisableBitwardenCache: disableBitwardenCacheOption(options.DisableBitwardenCache, manifestPolicy.BitwardenCache),
 		Shell:                 strings.TrimSpace(options.Shell),
 	})
 }
@@ -55,6 +57,7 @@ func resolveManifestBackendPolicy(options OpenFromManifestOptions) (BackendPolic
 type manifestPolicyResolution struct {
 	Policy         BackendPolicy
 	Source         string
+	BitwardenCache bool
 }
 
 func resolveManifestPolicy(options OpenFromManifestOptions) (manifestPolicyResolution, error) {
@@ -84,15 +87,22 @@ func resolveManifestPolicy(options OpenFromManifestOptions) (manifestPolicyResol
 			return manifestPolicyResolution{
 				Policy:         BackendAuto,
 				Source:         "",
+				BitwardenCache: true,
 			}, nil
 		}
 		return manifestPolicyResolution{}, fmt.Errorf("load runtime manifest from %q: %w", startDir, err)
 	}
 
+	bitwardenCache := true
+	if file.SecretStore.BitwardenCache != nil {
+		bitwardenCache = *file.SecretStore.BitwardenCache
+	}
+
 	if strings.TrimSpace(file.SecretStore.BackendPolicy) == "" {
 		return manifestPolicyResolution{
 			Policy:         BackendAuto,
 			Source:         strings.TrimSpace(manifestPath),
+			BitwardenCache: bitwardenCache,
 		}, nil
 	}
 
@@ -108,5 +118,10 @@ func resolveManifestPolicy(options OpenFromManifestOptions) (manifestPolicyResol
 	return manifestPolicyResolution{
 		Policy:         policy,
 		Source:         strings.TrimSpace(manifestPath),
+		BitwardenCache: bitwardenCache,
 	}, nil
 }
+
+func disableBitwardenCacheOption(runtimeDisabled bool, manifestEnabled bool) bool {
+	return runtimeDisabled || !manifestEnabled
+}

secretstore/manifest_open_test.go

@@ -111,6 +111,33 @@ func TestOpenFromManifestReturnsExplicitErrorForInvalidManifestPolicy(t *testing
 	}
 }
 
+func TestResolveManifestPolicyPreservesBitwardenCacheDisable(t *testing.T) {
+	cacheDisabled := false
+	resolution, err := resolveManifestPolicy(OpenFromManifestOptions{
+		ServiceName: "email-mcp",
+		ExecutableResolver: func() (string, error) {
+			return filepath.Join(string(filepath.Separator), "opt", "email-mcp", "bin", "email-mcp"), nil
+		},
+		ManifestLoader: func(startDir string) (manifest.File, string, error) {
+			return manifest.File{
+				SecretStore: manifest.SecretStore{
+					BackendPolicy:  string(BackendBitwardenCLI),
+					BitwardenCache: &cacheDisabled,
+				},
+			}, filepath.Join(startDir, manifest.DefaultFile), nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("resolveManifestPolicy returned error: %v", err)
+	}
+	if resolution.BitwardenCache {
+		t.Fatal("resolution BitwardenCache = true, want false")
+	}
+	if resolution.Policy != BackendBitwardenCLI {
+		t.Fatalf("resolution policy = %q, want %q", resolution.Policy, BackendBitwardenCLI)
+	}
+}
+
 func TestOpenFromManifestReturnsExecutableResolutionError(t *testing.T) {
 	execErr := errors.New("boom")
 	_, err := OpenFromManifest(OpenFromManifestOptions{

secretstore/runtime.go

@@ -15,6 +15,7 @@ type DescribeRuntimeOptions struct {
 	KWalletFolder         string
 	BitwardenCommand      string
 	BitwardenDebug        bool
+	DisableBitwardenCache bool
 	Shell                 string
 	ManifestLoader        ManifestLoader
 	ExecutableResolver    ExecutableResolver
@@ -52,6 +53,7 @@ func DescribeRuntime(options DescribeRuntimeOptions) (RuntimeDescription, error)
 		KWalletAppID:          options.KWalletAppID,
 		KWalletFolder:         options.KWalletFolder,
 		BitwardenCommand:      options.BitwardenCommand,
+		DisableBitwardenCache: options.DisableBitwardenCache,
 		Shell:                 options.Shell,
 		ManifestLoader:        options.ManifestLoader,
 		ExecutableResolver:    options.ExecutableResolver,
@@ -75,6 +77,7 @@ func DescribeRuntime(options DescribeRuntimeOptions) (RuntimeDescription, error)
 		KWalletFolder:         options.KWalletFolder,
 		BitwardenCommand:      options.BitwardenCommand,
 		BitwardenDebug:        options.BitwardenDebug,
+		DisableBitwardenCache: disableBitwardenCacheOption(options.DisableBitwardenCache, resolution.BitwardenCache),
 		Shell:                 options.Shell,
 	})
 	if openErr != nil {

secretstore/store.go

@@ -38,6 +38,7 @@ type Options struct {
 	KWalletFolder         string
 	BitwardenCommand      string
 	BitwardenDebug        bool
+	DisableBitwardenCache bool
 	Shell                 string
 }