diff --git a/README.md b/README.md
index 5c3625e8f..88192a216 100644
--- a/README.md
+++ b/README.md
@@ -166,6 +166,12 @@ Check [traps](./windows/Multi-booting.md)
    ssh-add ~/.ssh/id_ed25519
    ```
 
+1. Restore encrepted secrets from private git repository
+
+   ```bash
+   git clone 'git@example.com:password-store.git' "$PASSWORD_STORE_DIR"
+   ```
+
 1. [Restore encrypted rclone.conf from STDIN](config/rclone.md)
 
 1. Restore shell history
diff --git a/config/rclone.md b/config/rclone.md
index f4411d8ac..eee0617bc 100644
--- a/config/rclone.md
+++ b/config/rclone.md
@@ -35,16 +35,9 @@ hx "$(rclone config file | tail -1)"
 
 Don't save the file in this repository even if it is encrypted with agenix or sops-nix.
 
-## Persist the token in a session
+## Decrypt the config in a session
 
-Always need the token when modifying config is too annoy.\
-Now it reads from `RCLONE_PASSWORD_COMMAND`.\
-Or directly set `RCLONE_CONFIG_PASS` as this.\
-(`read -s` does not work in zsh)
-
-```bash
-export RCLONE_CONFIG_PASS="$(hx)"
-```
+The token should be injected with `RCLONE_PASSWORD_COMMAND`.
 
 ## Mount
 
diff --git a/dependencies/goldwarden/completions.bash b/dependencies/goldwarden/completions.bash
deleted file mode 100644
index 559572f57..000000000
--- a/dependencies/goldwarden/completions.bash
+++ /dev/null
@@ -1,338 +0,0 @@
-# bash completion V2 for goldwarden                           -*- shell-script -*-
-
-__goldwarden_debug()
-{
-    if [[ -n ${BASH_COMP_DEBUG_FILE-} ]]; then
-        echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
-    fi
-}
-
-# Macs have bash3 for which the bash-completion package doesn't include
-# _init_completion. This is a minimal version of that function.
-__goldwarden_init_completion()
-{
-    COMPREPLY=()
-    _get_comp_words_by_ref "$@" cur prev words cword
-}
-
-# This function calls the goldwarden program to obtain the completion
-# results and the directive.  It fills the 'out' and 'directive' vars.
-__goldwarden_get_completion_results() {
-    local requestComp lastParam lastChar args
-
-    # Prepare the command to request completions for the program.
-    # Calling ${words[0]} instead of directly goldwarden allows handling aliases
-    args=("${words[@]:1}")
-    requestComp="${words[0]} __complete ${args[*]}"
-
-    lastParam=${words[$((${#words[@]}-1))]}
-    lastChar=${lastParam:$((${#lastParam}-1)):1}
-    __goldwarden_debug "lastParam ${lastParam}, lastChar ${lastChar}"
-
-    if [[ -z ${cur} && ${lastChar} != = ]]; then
-        # If the last parameter is complete (there is a space following it)
-        # We add an extra empty parameter so we can indicate this to the go method.
-        __goldwarden_debug "Adding extra empty parameter"
-        requestComp="${requestComp} ''"
-    fi
-
-    # When completing a flag with an = (e.g., goldwarden -n=<TAB>)
-    # bash focuses on the part after the =, so we need to remove
-    # the flag part from $cur
-    if [[ ${cur} == -*=* ]]; then
-        cur="${cur#*=}"
-    fi
-
-    __goldwarden_debug "Calling ${requestComp}"
-    # Use eval to handle any environment variables and such
-    out=$(eval "${requestComp}" 2>/dev/null)
-
-    # Extract the directive integer at the very end of the output following a colon (:)
-    directive=${out##*:}
-    # Remove the directive
-    out=${out%:*}
-    if [[ ${directive} == "${out}" ]]; then
-        # There is not directive specified
-        directive=0
-    fi
-    __goldwarden_debug "The completion directive is: ${directive}"
-    __goldwarden_debug "The completions are: ${out}"
-}
-
-__goldwarden_process_completion_results() {
-    local shellCompDirectiveError=1
-    local shellCompDirectiveNoSpace=2
-    local shellCompDirectiveNoFileComp=4
-    local shellCompDirectiveFilterFileExt=8
-    local shellCompDirectiveFilterDirs=16
-    local shellCompDirectiveKeepOrder=32
-
-    if (((directive & shellCompDirectiveError) != 0)); then
-        # Error code.  No completion.
-        __goldwarden_debug "Received error from custom completion go code"
-        return
-    else
-        if (((directive & shellCompDirectiveNoSpace) != 0)); then
-            if [[ $(type -t compopt) == builtin ]]; then
-                __goldwarden_debug "Activating no space"
-                compopt -o nospace
-            else
-                __goldwarden_debug "No space directive not supported in this version of bash"
-            fi
-        fi
-        if (((directive & shellCompDirectiveKeepOrder) != 0)); then
-            if [[ $(type -t compopt) == builtin ]]; then
-                # no sort isn't supported for bash less than < 4.4
-                if [[ ${BASH_VERSINFO[0]} -lt 4 || ( ${BASH_VERSINFO[0]} -eq 4 && ${BASH_VERSINFO[1]} -lt 4 ) ]]; then
-                    __goldwarden_debug "No sort directive not supported in this version of bash"
-                else
-                    __goldwarden_debug "Activating keep order"
-                    compopt -o nosort
-                fi
-            else
-                __goldwarden_debug "No sort directive not supported in this version of bash"
-            fi
-        fi
-        if (((directive & shellCompDirectiveNoFileComp) != 0)); then
-            if [[ $(type -t compopt) == builtin ]]; then
-                __goldwarden_debug "Activating no file completion"
-                compopt +o default
-            else
-                __goldwarden_debug "No file completion directive not supported in this version of bash"
-            fi
-        fi
-    fi
-
-    # Separate activeHelp from normal completions
-    local completions=()
-    local activeHelp=()
-    __goldwarden_extract_activeHelp
-
-    if (((directive & shellCompDirectiveFilterFileExt) != 0)); then
-        # File extension filtering
-        local fullFilter filter filteringCmd
-
-        # Do not use quotes around the $completions variable or else newline
-        # characters will be kept.
-        for filter in ${completions[*]}; do
-            fullFilter+="$filter|"
-        done
-
-        filteringCmd="_filedir $fullFilter"
-        __goldwarden_debug "File filtering command: $filteringCmd"
-        $filteringCmd
-    elif (((directive & shellCompDirectiveFilterDirs) != 0)); then
-        # File completion for directories only
-
-        local subdir
-        subdir=${completions[0]}
-        if [[ -n $subdir ]]; then
-            __goldwarden_debug "Listing directories in $subdir"
-            pushd "$subdir" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return
-        else
-            __goldwarden_debug "Listing directories in ."
-            _filedir -d
-        fi
-    else
-        __goldwarden_handle_completion_types
-    fi
-
-    __goldwarden_handle_special_char "$cur" :
-    __goldwarden_handle_special_char "$cur" =
-
-    # Print the activeHelp statements before we finish
-    if ((${#activeHelp[*]} != 0)); then
-        printf "\n";
-        printf "%s\n" "${activeHelp[@]}"
-        printf "\n"
-
-        # The prompt format is only available from bash 4.4.
-        # We test if it is available before using it.
-        if (x=${PS1@P}) 2> /dev/null; then
-            printf "%s" "${PS1@P}${COMP_LINE[@]}"
-        else
-            # Can't print the prompt.  Just print the
-            # text the user had typed, it is workable enough.
-            printf "%s" "${COMP_LINE[@]}"
-        fi
-    fi
-}
-
-# Separate activeHelp lines from real completions.
-# Fills the $activeHelp and $completions arrays.
-__goldwarden_extract_activeHelp() {
-    local activeHelpMarker="_activeHelp_ "
-    local endIndex=${#activeHelpMarker}
-
-    while IFS='' read -r comp; do
-        if [[ ${comp:0:endIndex} == $activeHelpMarker ]]; then
-            comp=${comp:endIndex}
-            __goldwarden_debug "ActiveHelp found: $comp"
-            if [[ -n $comp ]]; then
-                activeHelp+=("$comp")
-            fi
-        else
-            # Not an activeHelp line but a normal completion
-            completions+=("$comp")
-        fi
-    done <<<"${out}"
-}
-
-__goldwarden_handle_completion_types() {
-    __goldwarden_debug "__goldwarden_handle_completion_types: COMP_TYPE is $COMP_TYPE"
-
-    case $COMP_TYPE in
-    37|42)
-        # Type: menu-complete/menu-complete-backward and insert-completions
-        # If the user requested inserting one completion at a time, or all
-        # completions at once on the command-line we must remove the descriptions.
-        # https://github.com/spf13/cobra/issues/1508
-        local tab=$'\t' comp
-        while IFS='' read -r comp; do
-            [[ -z $comp ]] && continue
-            # Strip any description
-            comp=${comp%%$tab*}
-            # Only consider the completions that match
-            if [[ $comp == "$cur"* ]]; then
-                COMPREPLY+=("$comp")
-            fi
-        done < <(printf "%s\n" "${completions[@]}")
-        ;;
-
-    *)
-        # Type: complete (normal completion)
-        __goldwarden_handle_standard_completion_case
-        ;;
-    esac
-}
-
-__goldwarden_handle_standard_completion_case() {
-    local tab=$'\t' comp
-
-    # Short circuit to optimize if we don't have descriptions
-    if [[ "${completions[*]}" != *$tab* ]]; then
-        IFS=$'\n' read -ra COMPREPLY -d '' < <(compgen -W "${completions[*]}" -- "$cur")
-        return 0
-    fi
-
-    local longest=0
-    local compline
-    # Look for the longest completion so that we can format things nicely
-    while IFS='' read -r compline; do
-        [[ -z $compline ]] && continue
-        # Strip any description before checking the length
-        comp=${compline%%$tab*}
-        # Only consider the completions that match
-        [[ $comp == "$cur"* ]] || continue
-        COMPREPLY+=("$compline")
-        if ((${#comp}>longest)); then
-            longest=${#comp}
-        fi
-    done < <(printf "%s\n" "${completions[@]}")
-
-    # If there is a single completion left, remove the description text
-    if ((${#COMPREPLY[*]} == 1)); then
-        __goldwarden_debug "COMPREPLY[0]: ${COMPREPLY[0]}"
-        comp="${COMPREPLY[0]%%$tab*}"
-        __goldwarden_debug "Removed description from single completion, which is now: ${comp}"
-        COMPREPLY[0]=$comp
-    else # Format the descriptions
-        __goldwarden_format_comp_descriptions $longest
-    fi
-}
-
-__goldwarden_handle_special_char()
-{
-    local comp="$1"
-    local char=$2
-    if [[ "$comp" == *${char}* && "$COMP_WORDBREAKS" == *${char}* ]]; then
-        local word=${comp%"${comp##*${char}}"}
-        local idx=${#COMPREPLY[*]}
-        while ((--idx >= 0)); do
-            COMPREPLY[idx]=${COMPREPLY[idx]#"$word"}
-        done
-    fi
-}
-
-__goldwarden_format_comp_descriptions()
-{
-    local tab=$'\t'
-    local comp desc maxdesclength
-    local longest=$1
-
-    local i ci
-    for ci in ${!COMPREPLY[*]}; do
-        comp=${COMPREPLY[ci]}
-        # Properly format the description string which follows a tab character if there is one
-        if [[ "$comp" == *$tab* ]]; then
-            __goldwarden_debug "Original comp: $comp"
-            desc=${comp#*$tab}
-            comp=${comp%%$tab*}
-
-            # $COLUMNS stores the current shell width.
-            # Remove an extra 4 because we add 2 spaces and 2 parentheses.
-            maxdesclength=$(( COLUMNS - longest - 4 ))
-
-            # Make sure we can fit a description of at least 8 characters
-            # if we are to align the descriptions.
-            if ((maxdesclength > 8)); then
-                # Add the proper number of spaces to align the descriptions
-                for ((i = ${#comp} ; i < longest ; i++)); do
-                    comp+=" "
-                done
-            else
-                # Don't pad the descriptions so we can fit more text after the completion
-                maxdesclength=$(( COLUMNS - ${#comp} - 4 ))
-            fi
-
-            # If there is enough space for any description text,
-            # truncate the descriptions that are too long for the shell width
-            if ((maxdesclength > 0)); then
-                if ((${#desc} > maxdesclength)); then
-                    desc=${desc:0:$(( maxdesclength - 1 ))}
-                    desc+="…"
-                fi
-                comp+="  ($desc)"
-            fi
-            COMPREPLY[ci]=$comp
-            __goldwarden_debug "Final comp: $comp"
-        fi
-    done
-}
-
-__start_goldwarden()
-{
-    local cur prev words cword split
-
-    COMPREPLY=()
-
-    # Call _init_completion from the bash-completion package
-    # to prepare the arguments properly
-    if declare -F _init_completion >/dev/null 2>&1; then
-        _init_completion -n =: || return
-    else
-        __goldwarden_init_completion -n =: || return
-    fi
-
-    __goldwarden_debug
-    __goldwarden_debug "========= starting completion logic =========="
-    __goldwarden_debug "cur is ${cur}, words[*] is ${words[*]}, #words[@] is ${#words[@]}, cword is $cword"
-
-    # The user could have moved the cursor backwards on the command-line.
-    # We need to trigger completion from the $cword location, so we need
-    # to truncate the command-line ($words) up to the $cword location.
-    words=("${words[@]:0:$cword+1}")
-    __goldwarden_debug "Truncated words[*]: ${words[*]},"
-
-    local out directive
-    __goldwarden_get_completion_results
-    __goldwarden_process_completion_results
-}
-
-if [[ $(type -t compopt) = "builtin" ]]; then
-    complete -o default -F __start_goldwarden goldwarden
-else
-    complete -o default -o nospace -F __start_goldwarden goldwarden
-fi
-
-# ex: ts=4 sw=4 et filetype=sh
diff --git a/dependencies/goldwarden/completions.fish b/dependencies/goldwarden/completions.fish
deleted file mode 100644
index 94c592857..000000000
--- a/dependencies/goldwarden/completions.fish
+++ /dev/null
@@ -1,235 +0,0 @@
-# fish completion for goldwarden                           -*- shell-script -*-
-
-function __goldwarden_debug
-    set -l file "$BASH_COMP_DEBUG_FILE"
-    if test -n "$file"
-        echo "$argv" >> $file
-    end
-end
-
-function __goldwarden_perform_completion
-    __goldwarden_debug "Starting __goldwarden_perform_completion"
-
-    # Extract all args except the last one
-    set -l args (commandline -opc)
-    # Extract the last arg and escape it in case it is a space
-    set -l lastArg (string escape -- (commandline -ct))
-
-    __goldwarden_debug "args: $args"
-    __goldwarden_debug "last arg: $lastArg"
-
-    # Disable ActiveHelp which is not supported for fish shell
-    set -l requestComp "GOLDWARDEN_ACTIVE_HELP=0 $args[1] __complete $args[2..-1] $lastArg"
-
-    __goldwarden_debug "Calling $requestComp"
-    set -l results (eval $requestComp 2> /dev/null)
-
-    # Some programs may output extra empty lines after the directive.
-    # Let's ignore them or else it will break completion.
-    # Ref: https://github.com/spf13/cobra/issues/1279
-    for line in $results[-1..1]
-        if test (string trim -- $line) = ""
-            # Found an empty line, remove it
-            set results $results[1..-2]
-        else
-            # Found non-empty line, we have our proper output
-            break
-        end
-    end
-
-    set -l comps $results[1..-2]
-    set -l directiveLine $results[-1]
-
-    # For Fish, when completing a flag with an = (e.g., <program> -n=<TAB>)
-    # completions must be prefixed with the flag
-    set -l flagPrefix (string match -r -- '-.*=' "$lastArg")
-
-    __goldwarden_debug "Comps: $comps"
-    __goldwarden_debug "DirectiveLine: $directiveLine"
-    __goldwarden_debug "flagPrefix: $flagPrefix"
-
-    for comp in $comps
-        printf "%s%s\n" "$flagPrefix" "$comp"
-    end
-
-    printf "%s\n" "$directiveLine"
-end
-
-# this function limits calls to __goldwarden_perform_completion, by caching the result behind $__goldwarden_perform_completion_once_result
-function __goldwarden_perform_completion_once
-    __goldwarden_debug "Starting __goldwarden_perform_completion_once"
-
-    if test -n "$__goldwarden_perform_completion_once_result"
-        __goldwarden_debug "Seems like a valid result already exists, skipping __goldwarden_perform_completion"
-        return 0
-    end
-
-    set --global __goldwarden_perform_completion_once_result (__goldwarden_perform_completion)
-    if test -z "$__goldwarden_perform_completion_once_result"
-        __goldwarden_debug "No completions, probably due to a failure"
-        return 1
-    end
-
-    __goldwarden_debug "Performed completions and set __goldwarden_perform_completion_once_result"
-    return 0
-end
-
-# this function is used to clear the $__goldwarden_perform_completion_once_result variable after completions are run
-function __goldwarden_clear_perform_completion_once_result
-    __goldwarden_debug ""
-    __goldwarden_debug "========= clearing previously set __goldwarden_perform_completion_once_result variable =========="
-    set --erase __goldwarden_perform_completion_once_result
-    __goldwarden_debug "Successfully erased the variable __goldwarden_perform_completion_once_result"
-end
-
-function __goldwarden_requires_order_preservation
-    __goldwarden_debug ""
-    __goldwarden_debug "========= checking if order preservation is required =========="
-
-    __goldwarden_perform_completion_once
-    if test -z "$__goldwarden_perform_completion_once_result"
-        __goldwarden_debug "Error determining if order preservation is required"
-        return 1
-    end
-
-    set -l directive (string sub --start 2 $__goldwarden_perform_completion_once_result[-1])
-    __goldwarden_debug "Directive is: $directive"
-
-    set -l shellCompDirectiveKeepOrder 32
-    set -l keeporder (math (math --scale 0 $directive / $shellCompDirectiveKeepOrder) % 2)
-    __goldwarden_debug "Keeporder is: $keeporder"
-
-    if test $keeporder -ne 0
-        __goldwarden_debug "This does require order preservation"
-        return 0
-    end
-
-    __goldwarden_debug "This doesn't require order preservation"
-    return 1
-end
-
-
-# This function does two things:
-# - Obtain the completions and store them in the global __goldwarden_comp_results
-# - Return false if file completion should be performed
-function __goldwarden_prepare_completions
-    __goldwarden_debug ""
-    __goldwarden_debug "========= starting completion logic =========="
-
-    # Start fresh
-    set --erase __goldwarden_comp_results
-
-    __goldwarden_perform_completion_once
-    __goldwarden_debug "Completion results: $__goldwarden_perform_completion_once_result"
-
-    if test -z "$__goldwarden_perform_completion_once_result"
-        __goldwarden_debug "No completion, probably due to a failure"
-        # Might as well do file completion, in case it helps
-        return 1
-    end
-
-    set -l directive (string sub --start 2 $__goldwarden_perform_completion_once_result[-1])
-    set --global __goldwarden_comp_results $__goldwarden_perform_completion_once_result[1..-2]
-
-    __goldwarden_debug "Completions are: $__goldwarden_comp_results"
-    __goldwarden_debug "Directive is: $directive"
-
-    set -l shellCompDirectiveError 1
-    set -l shellCompDirectiveNoSpace 2
-    set -l shellCompDirectiveNoFileComp 4
-    set -l shellCompDirectiveFilterFileExt 8
-    set -l shellCompDirectiveFilterDirs 16
-
-    if test -z "$directive"
-        set directive 0
-    end
-
-    set -l compErr (math (math --scale 0 $directive / $shellCompDirectiveError) % 2)
-    if test $compErr -eq 1
-        __goldwarden_debug "Received error directive: aborting."
-        # Might as well do file completion, in case it helps
-        return 1
-    end
-
-    set -l filefilter (math (math --scale 0 $directive / $shellCompDirectiveFilterFileExt) % 2)
-    set -l dirfilter (math (math --scale 0 $directive / $shellCompDirectiveFilterDirs) % 2)
-    if test $filefilter -eq 1; or test $dirfilter -eq 1
-        __goldwarden_debug "File extension filtering or directory filtering not supported"
-        # Do full file completion instead
-        return 1
-    end
-
-    set -l nospace (math (math --scale 0 $directive / $shellCompDirectiveNoSpace) % 2)
-    set -l nofiles (math (math --scale 0 $directive / $shellCompDirectiveNoFileComp) % 2)
-
-    __goldwarden_debug "nospace: $nospace, nofiles: $nofiles"
-
-    # If we want to prevent a space, or if file completion is NOT disabled,
-    # we need to count the number of valid completions.
-    # To do so, we will filter on prefix as the completions we have received
-    # may not already be filtered so as to allow fish to match on different
-    # criteria than the prefix.
-    if test $nospace -ne 0; or test $nofiles -eq 0
-        set -l prefix (commandline -t | string escape --style=regex)
-        __goldwarden_debug "prefix: $prefix"
-
-        set -l completions (string match -r -- "^$prefix.*" $__goldwarden_comp_results)
-        set --global __goldwarden_comp_results $completions
-        __goldwarden_debug "Filtered completions are: $__goldwarden_comp_results"
-
-        # Important not to quote the variable for count to work
-        set -l numComps (count $__goldwarden_comp_results)
-        __goldwarden_debug "numComps: $numComps"
-
-        if test $numComps -eq 1; and test $nospace -ne 0
-            # We must first split on \t to get rid of the descriptions to be
-            # able to check what the actual completion will be.
-            # We don't need descriptions anyway since there is only a single
-            # real completion which the shell will expand immediately.
-            set -l split (string split --max 1 \t $__goldwarden_comp_results[1])
-
-            # Fish won't add a space if the completion ends with any
-            # of the following characters: @=/:.,
-            set -l lastChar (string sub -s -1 -- $split)
-            if not string match -r -q "[@=/:.,]" -- "$lastChar"
-                # In other cases, to support the "nospace" directive we trick the shell
-                # by outputting an extra, longer completion.
-                __goldwarden_debug "Adding second completion to perform nospace directive"
-                set --global __goldwarden_comp_results $split[1] $split[1].
-                __goldwarden_debug "Completions are now: $__goldwarden_comp_results"
-            end
-        end
-
-        if test $numComps -eq 0; and test $nofiles -eq 0
-            # To be consistent with bash and zsh, we only trigger file
-            # completion when there are no other completions
-            __goldwarden_debug "Requesting file completion"
-            return 1
-        end
-    end
-
-    return 0
-end
-
-# Since Fish completions are only loaded once the user triggers them, we trigger them ourselves
-# so we can properly delete any completions provided by another script.
-# Only do this if the program can be found, or else fish may print some errors; besides,
-# the existing completions will only be loaded if the program can be found.
-if type -q "goldwarden"
-    # The space after the program name is essential to trigger completion for the program
-    # and not completion of the program name itself.
-    # Also, we use '> /dev/null 2>&1' since '&>' is not supported in older versions of fish.
-    complete --do-complete "goldwarden " > /dev/null 2>&1
-end
-
-# Remove any pre-existing completions for the program since we will be handling all of them.
-complete -c goldwarden -e
-
-# this will get called after the two calls below and clear the $__goldwarden_perform_completion_once_result global
-complete -c goldwarden -n '__goldwarden_clear_perform_completion_once_result'
-# The call to __goldwarden_prepare_completions will setup __goldwarden_comp_results
-# which provides the program's completion choices.
-# If this doesn't require order preservation, we don't use the -k flag
-complete -c goldwarden -n 'not __goldwarden_requires_order_preservation && __goldwarden_prepare_completions' -f -a '$__goldwarden_comp_results'
-# otherwise we use the -k flag
-complete -k -c goldwarden -n '__goldwarden_requires_order_preservation && __goldwarden_prepare_completions' -f -a '$__goldwarden_comp_results'
diff --git a/dependencies/goldwarden/completions.zsh b/dependencies/goldwarden/completions.zsh
deleted file mode 100644
index 8957b37a1..000000000
--- a/dependencies/goldwarden/completions.zsh
+++ /dev/null
@@ -1,212 +0,0 @@
-#compdef goldwarden
-compdef _goldwarden goldwarden
-
-# zsh completion for goldwarden                           -*- shell-script -*-
-
-__goldwarden_debug()
-{
-    local file="$BASH_COMP_DEBUG_FILE"
-    if [[ -n ${file} ]]; then
-        echo "$*" >> "${file}"
-    fi
-}
-
-_goldwarden()
-{
-    local shellCompDirectiveError=1
-    local shellCompDirectiveNoSpace=2
-    local shellCompDirectiveNoFileComp=4
-    local shellCompDirectiveFilterFileExt=8
-    local shellCompDirectiveFilterDirs=16
-    local shellCompDirectiveKeepOrder=32
-
-    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace keepOrder
-    local -a completions
-
-    __goldwarden_debug "\n========= starting completion logic =========="
-    __goldwarden_debug "CURRENT: ${CURRENT}, words[*]: ${words[*]}"
-
-    # The user could have moved the cursor backwards on the command-line.
-    # We need to trigger completion from the $CURRENT location, so we need
-    # to truncate the command-line ($words) up to the $CURRENT location.
-    # (We cannot use $CURSOR as its value does not work when a command is an alias.)
-    words=("${=words[1,CURRENT]}")
-    __goldwarden_debug "Truncated words[*]: ${words[*]},"
-
-    lastParam=${words[-1]}
-    lastChar=${lastParam[-1]}
-    __goldwarden_debug "lastParam: ${lastParam}, lastChar: ${lastChar}"
-
-    # For zsh, when completing a flag with an = (e.g., goldwarden -n=<TAB>)
-    # completions must be prefixed with the flag
-    setopt local_options BASH_REMATCH
-    if [[ "${lastParam}" =~ '-.*=' ]]; then
-        # We are dealing with a flag with an =
-        flagPrefix="-P ${BASH_REMATCH}"
-    fi
-
-    # Prepare the command to obtain completions
-    requestComp="${words[1]} __complete ${words[2,-1]}"
-    if [ "${lastChar}" = "" ]; then
-        # If the last parameter is complete (there is a space following it)
-        # We add an extra empty parameter so we can indicate this to the go completion code.
-        __goldwarden_debug "Adding extra empty parameter"
-        requestComp="${requestComp} \"\""
-    fi
-
-    __goldwarden_debug "About to call: eval ${requestComp}"
-
-    # Use eval to handle any environment variables and such
-    out=$(eval ${requestComp} 2>/dev/null)
-    __goldwarden_debug "completion output: ${out}"
-
-    # Extract the directive integer following a : from the last line
-    local lastLine
-    while IFS='\n' read -r line; do
-        lastLine=${line}
-    done < <(printf "%s\n" "${out[@]}")
-    __goldwarden_debug "last line: ${lastLine}"
-
-    if [ "${lastLine[1]}" = : ]; then
-        directive=${lastLine[2,-1]}
-        # Remove the directive including the : and the newline
-        local suffix
-        (( suffix=${#lastLine}+2))
-        out=${out[1,-$suffix]}
-    else
-        # There is no directive specified.  Leave $out as is.
-        __goldwarden_debug "No directive found.  Setting do default"
-        directive=0
-    fi
-
-    __goldwarden_debug "directive: ${directive}"
-    __goldwarden_debug "completions: ${out}"
-    __goldwarden_debug "flagPrefix: ${flagPrefix}"
-
-    if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then
-        __goldwarden_debug "Completion received error. Ignoring completions."
-        return
-    fi
-
-    local activeHelpMarker="_activeHelp_ "
-    local endIndex=${#activeHelpMarker}
-    local startIndex=$((${#activeHelpMarker}+1))
-    local hasActiveHelp=0
-    while IFS='\n' read -r comp; do
-        # Check if this is an activeHelp statement (i.e., prefixed with $activeHelpMarker)
-        if [ "${comp[1,$endIndex]}" = "$activeHelpMarker" ];then
-            __goldwarden_debug "ActiveHelp found: $comp"
-            comp="${comp[$startIndex,-1]}"
-            if [ -n "$comp" ]; then
-                compadd -x "${comp}"
-                __goldwarden_debug "ActiveHelp will need delimiter"
-                hasActiveHelp=1
-            fi
-
-            continue
-        fi
-
-        if [ -n "$comp" ]; then
-            # If requested, completions are returned with a description.
-            # The description is preceded by a TAB character.
-            # For zsh's _describe, we need to use a : instead of a TAB.
-            # We first need to escape any : as part of the completion itself.
-            comp=${comp//:/\\:}
-
-            local tab="$(printf '\t')"
-            comp=${comp//$tab/:}
-
-            __goldwarden_debug "Adding completion: ${comp}"
-            completions+=${comp}
-            lastComp=$comp
-        fi
-    done < <(printf "%s\n" "${out[@]}")
-
-    # Add a delimiter after the activeHelp statements, but only if:
-    # - there are completions following the activeHelp statements, or
-    # - file completion will be performed (so there will be choices after the activeHelp)
-    if [ $hasActiveHelp -eq 1 ]; then
-        if [ ${#completions} -ne 0 ] || [ $((directive & shellCompDirectiveNoFileComp)) -eq 0 ]; then
-            __goldwarden_debug "Adding activeHelp delimiter"
-            compadd -x "--"
-            hasActiveHelp=0
-        fi
-    fi
-
-    if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then
-        __goldwarden_debug "Activating nospace."
-        noSpace="-S ''"
-    fi
-
-    if [ $((directive & shellCompDirectiveKeepOrder)) -ne 0 ]; then
-        __goldwarden_debug "Activating keep order."
-        keepOrder="-V"
-    fi
-
-    if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
-        # File extension filtering
-        local filteringCmd
-        filteringCmd='_files'
-        for filter in ${completions[@]}; do
-            if [ ${filter[1]} != '*' ]; then
-                # zsh requires a glob pattern to do file filtering
-                filter="\*.$filter"
-            fi
-            filteringCmd+=" -g $filter"
-        done
-        filteringCmd+=" ${flagPrefix}"
-
-        __goldwarden_debug "File filtering command: $filteringCmd"
-        _arguments '*:filename:'"$filteringCmd"
-    elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
-        # File completion for directories only
-        local subdir
-        subdir="${completions[1]}"
-        if [ -n "$subdir" ]; then
-            __goldwarden_debug "Listing directories in $subdir"
-            pushd "${subdir}" >/dev/null 2>&1
-        else
-            __goldwarden_debug "Listing directories in ."
-        fi
-
-        local result
-        _arguments '*:dirname:_files -/'" ${flagPrefix}"
-        result=$?
-        if [ -n "$subdir" ]; then
-            popd >/dev/null 2>&1
-        fi
-        return $result
-    else
-        __goldwarden_debug "Calling _describe"
-        if eval _describe $keepOrder "completions" completions $flagPrefix $noSpace; then
-            __goldwarden_debug "_describe found some completions"
-
-            # Return the success of having called _describe
-            return 0
-        else
-            __goldwarden_debug "_describe did not find completions."
-            __goldwarden_debug "Checking if we should do file completion."
-            if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then
-                __goldwarden_debug "deactivating file completion"
-
-                # We must return an error code here to let zsh know that there were no
-                # completions found by _describe; this is what will trigger other
-                # matching algorithms to attempt to find completions.
-                # For example zsh can match letters in the middle of words.
-                return 1
-            else
-                # Perform file completion
-                __goldwarden_debug "Activating file completion"
-
-                # We must return the result of this command, so it must be the
-                # last command, or else we must store its result to return it.
-                _arguments '*:filename:_files'" ${flagPrefix}"
-            fi
-        fi
-    fi
-}
-
-# don't run the completion function when being source-ed or eval-ed
-if [ "$funcstack[1]" = "_goldwarden" ]; then
-    _goldwarden
-fi
diff --git a/home-manager/bash.nix b/home-manager/bash.nix
index 3d9c184f4..23127de63 100644
--- a/home-manager/bash.nix
+++ b/home-manager/bash.nix
@@ -125,7 +125,6 @@
         source "${homemade-pkgs.cargo-make-completions}/share/bash-completion/completions/makers-completion.bash"
 
         source "${../dependencies/dprint/completions.bash}"
-        source "${../dependencies/goldwarden/completions.bash}"
 
         # Disable `Ctrl + S(no output tty)`
         ${lib.getBin pkgs.coreutils}/bin/stty stop undef
diff --git a/home-manager/common.nix b/home-manager/common.nix
index 6359ab278..e406bcf5f 100644
--- a/home-manager/common.nix
+++ b/home-manager/common.nix
@@ -64,6 +64,9 @@
       LESSCHARSET = "utf-8";
 
       STACK_XDG = "https://github.com/commercialhaskell/stack/blob/72f0a1273dd1121740501a159988fc23df2fb362/doc/stack_root.md?plain=1#L7-L11";
+
+      # Don't add needless quotation in the arguments. For example `pass show 'rclone'` does not work. It should be `pass show rclone`.
+      RCLONE_PASSWORD_COMMAND = "${lib.getExe pkgs.pass} show rclone";
     };
 
     sessionPath = [
diff --git a/home-manager/darwin.nix b/home-manager/darwin.nix
index 2706bd825..a9f65f0d4 100644
--- a/home-manager/darwin.nix
+++ b/home-manager/darwin.nix
@@ -16,8 +16,8 @@ lib.mkMerge [
     # https://github.com/midchildan/dotfiles/blob/fae87a3ef327c23031d8081333678f9472e4c0ed/nix/home/modules/gnupg/default.nix#L38
     xdg.dataFile."gnupg/gpg-agent.conf".text = ''
       grab
-      default-cache-ttl 60480000
-      max-cache-ttl 60480000
+      default-cache-ttl 604800
+      max-cache-ttl 604800
       pinentry-program ${pkgs.pinentry_mac}/Applications/pinentry-mac.app/Contents/MacOS/pinentry-mac
     '';
   })
diff --git a/home-manager/fish.nix b/home-manager/fish.nix
index 9a5c78196..3f65132bf 100644
--- a/home-manager/fish.nix
+++ b/home-manager/fish.nix
@@ -18,7 +18,6 @@
   # If added here, check the result of `bench_shells`: https://github.com/kachick/dotfiles/pull/423/files#r1503804605
   xdg.dataFile."fish/vendor_completions.d/podman.fish".source = "${pkgs.podman}/share/fish/vendor_completions.d/podman.fish";
   xdg.dataFile."fish/vendor_completions.d/dprint.fish".source = ../dependencies/dprint/completions.fish;
-  xdg.dataFile."fish/vendor_completions.d/goldwarden.fish".source = ../dependencies/goldwarden/completions.fish;
 
   # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/fish.nix
   programs.fish = {
diff --git a/home-manager/gpg.nix b/home-manager/gpg.nix
index 943a9e65d..002ef5519 100644
--- a/home-manager/gpg.nix
+++ b/home-manager/gpg.nix
@@ -29,14 +29,12 @@ in
 
     # Update [darwin.nix](darwin.nix) if changed this section
     #
-    # TODO: Reconsider the ttls with recent use
-    #
     # https://superuser.com/questions/624343/keep-gnupg-credentials-cached-for-entire-user-session
-    defaultCacheTtl = day * 700;
+    defaultCacheTtl = day * 7;
     # https://github.com/openbsd/src/blob/862f3f2587ccb85ac6d8602dd1601a861ae5a3e8/usr.bin/ssh/ssh-agent.1#L167-L173
     # ssh-agent sets it as infinite by default. So I can relax here (maybe)
     defaultCacheTtlSsh = day * 30;
-    maxCacheTtl = day * 700;
+    maxCacheTtl = day * 7;
 
     pinentryPackage = pkgs.pinentry-tty;
 
@@ -62,4 +60,9 @@ in
       personal-digest-preferences = "SHA512";
     };
   };
+
+  # https://github.com/nix-community/home-manager/blob/release-24.05/modules/programs/password-store.nix
+  programs.password-store = {
+    enable = true;
+  };
 }
diff --git a/home-manager/linux.nix b/home-manager/linux.nix
index aa6a887ff..392a48ab2 100644
--- a/home-manager/linux.nix
+++ b/home-manager/linux.nix
@@ -1,9 +1,4 @@
-{
-  pkgs,
-  lib,
-  homemade-pkgs,
-  ...
-}:
+{ pkgs, lib, ... }:
 
 # https://github.com/nix-community/home-manager/issues/414#issuecomment-427163925
 lib.mkMerge [
@@ -17,9 +12,5 @@ lib.mkMerge [
     };
 
     xdg.configFile."hypr/hyprland.conf".source = ../config/hyprland/hyprland.conf;
-
-    # For implementation, handling bitwarden logins which contains space seprared text here looks complex and buggy. So extracted to a script.
-    # And the dependent goldwarden does not support darwin yet: https://github.com/NixOS/nixpkgs/pull/278362/files#diff-062253d551cb2a1ebc07a298c69c8b69b1fb1152e8b08dc805e170ffe8134ae3R45
-    home.sessionVariables.RCLONE_PASSWORD_COMMAND = lib.getExe homemade-pkgs.get-rclone-config-password;
   })
 ]
diff --git a/home-manager/packages.nix b/home-manager/packages.nix
index 4eabd3ad0..f5386e662 100644
--- a/home-manager/packages.nix
+++ b/home-manager/packages.nix
@@ -47,6 +47,8 @@
     # GPG
     gnupg
 
+    pass
+
     # Do not specify vim and the plugins at here, it made collisions from home-manager vim module.
     # See following issues
     # - https://github.com/kachick/dotfiles/issues/280
diff --git a/home-manager/zsh.nix b/home-manager/zsh.nix
index 6c503e014..20538bbb3 100644
--- a/home-manager/zsh.nix
+++ b/home-manager/zsh.nix
@@ -261,7 +261,6 @@
       }
 
       source "${../dependencies/dprint/completions.zsh}"
-      source "${../dependencies/goldwarden/completions.zsh}"
 
       # Disable `Ctrl + S(no output tty)`
       ${lib.getBin pkgs.coreutils}/bin/stty stop undef
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index e89bd1d90..4ee8ca7bf 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -100,8 +100,9 @@
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
-  environment.systemPackages =
-    (with pkgs; [
+  environment.systemPackages = (
+    with pkgs;
+    [
       vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
       helix
       micro
@@ -133,12 +134,8 @@
       docker-compose
 
       chawan
-    ])
-    ++ (with edge-pkgs; [
-      # 3rd-party bitwarden helper, because of official cli does not have many core features
-      # Use latest because of nixos-24.05 distributing version has a crucial bug: https://github.com/quexten/goldwarden/issues/190
-      goldwarden
-    ]);
+    ]
+  );
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
@@ -161,13 +158,6 @@
 
   # programs.nix-ld.enable = false;
 
-  # Prefer NixOS modules rather than home-manager for easy setting up
-  programs.goldwarden = {
-    package = edge-pkgs.goldwarden;
-    enable = true;
-    useSshAgent = false;
-  };
-
   # https://nixos.wiki/wiki/Podman
   virtualisation = {
     containers.enable = true;
diff --git a/pkgs/bump_completions/bump_completions.bash b/pkgs/bump_completions/bump_completions.bash
index 0fc926a87..3164221ee 100644
--- a/pkgs/bump_completions/bump_completions.bash
+++ b/pkgs/bump_completions/bump_completions.bash
@@ -5,11 +5,3 @@ dprint completions fish >./dependencies/dprint/completions.fish
 git add ./dependencies/dprint
 git update-index -q --really-refresh
 git diff-index --quiet HEAD || git commit -m 'Update dprint completions' ./dependencies/dprint
-
-goldwarden completion bash >./dependencies/goldwarden/completions.bash
-goldwarden completion zsh >./dependencies/goldwarden/completions.zsh
-goldwarden completion fish >./dependencies/goldwarden/completions.fish
-
-git add ./dependencies/goldwarden
-git update-index -q --really-refresh
-git diff-index --quiet HEAD || git commit -m 'Update goldwarden completions' ./dependencies/goldwarden
diff --git a/pkgs/bump_completions/default.nix b/pkgs/bump_completions/default.nix
index 375efc6c8..9b1a95932 100644
--- a/pkgs/bump_completions/default.nix
+++ b/pkgs/bump_completions/default.nix
@@ -1,11 +1,12 @@
-{ pkgs, edge-pkgs, ... }:
+{ pkgs, ... }:
 pkgs.writeShellApplication rec {
   name = "bump_completions";
   text = builtins.readFile ./${name}.bash;
-  runtimeInputs =
-    (with pkgs; [
+  runtimeInputs = (
+    with pkgs;
+    [
       git
       dprint
-    ])
-    ++ [ edge-pkgs.goldwarden ];
+    ]
+  );
 }
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 3a33f1a36..0ad172fab 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -59,8 +59,6 @@
 
   posix_shared_functions = pkgs.callPackage ./posix_shared_functions { };
 
-  get-rclone-config-password = import ./get-rclone-config-password { inherit pkgs edge-pkgs; };
-
   micro-fzfinder = pkgs.callPackage ./micro-fzfinder { };
   micro-kdl = pkgs.callPackage ./micro-kdl { };
   micro-nordcolors = pkgs.callPackage ./micro-nordcolors { };
diff --git a/pkgs/get-rclone-config-password/default.nix b/pkgs/get-rclone-config-password/default.nix
deleted file mode 100644
index 99ab9a01d..000000000
--- a/pkgs/get-rclone-config-password/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ edge-pkgs, pkgs, ... }:
-pkgs.writeShellApplication rec {
-  name = "get-rclone-config-password";
-  text = builtins.readFile ./${name}.bash;
-  runtimeInputs = [ edge-pkgs.goldwarden ];
-}
diff --git a/pkgs/get-rclone-config-password/get-rclone-config-password.bash b/pkgs/get-rclone-config-password/get-rclone-config-password.bash
deleted file mode 100644
index 045a6ecb0..000000000
--- a/pkgs/get-rclone-config-password/get-rclone-config-password.bash
+++ /dev/null
@@ -1,2 +0,0 @@
-# Don't use the uuid for now, and using space separated name is broken when defined in environment variable
-goldwarden logins get --name 'Rclone - Configuration Password'