Add Firefox and Bitwarden to the shared desktop-applications profile

Tom wanted a browser and password manager provisioned declaratively:
Firefox and the Bitwarden desktop client join the existing GUI app
list, and bitwarden-cli joins the developer CLI tools. All three are
free-licensed in current nixpkgs, so no unfree-allowlist change is
needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

7 files changed, 56 insertions, 2 deletions

diff --git a/modules/home/desktop-apps.nix b/modules/home/desktop-apps.nix
index b42cb9d..882ce34 100644
--- a/modules/home/desktop-apps.nix
+++ b/modules/home/desktop-apps.nix
@@ -1,6 +1,6 @@
 { pkgs, lib, ... }:
 let
-  crossPlatformApps = [ pkgs.slack pkgs.discord pkgs.spotify ];
+  crossPlatformApps = [ pkgs.slack pkgs.discord pkgs.spotify pkgs.firefox pkgs.bitwarden-desktop ];
   linuxOnlyApps = lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.teams-for-linux;
   candidateApps = crossPlatformApps ++ linuxOnlyApps;
 in
diff --git a/modules/home/dev-tools.nix b/modules/home/dev-tools.nix
index efa0d86..9533ef5 100644
--- a/modules/home/dev-tools.nix
+++ b/modules/home/dev-tools.nix
@@ -9,5 +9,6 @@
     docker-compose
     kubectl
     awscli2
+    bitwarden-cli
   ]) ++ lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.claude-code) pkgs.claude-code;
 }
diff --git a/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/.openspec.yaml b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/.openspec.yaml
new file mode 100644
index 0000000..563fab5
--- /dev/null
+++ b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-09-21
diff --git a/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md
new file mode 100644
index 0000000..c67dd12
--- /dev/null
+++ b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md
@@ -0,0 +1,29 @@
+## Why
+
+The shared home-manager profile provisions chat/communication/music GUI apps (`desktop-applications`) and CLI tooling (`developer-environment`), but has no web browser and no password manager. Tom wants Firefox and Bitwarden (desktop app + CLI) available on any machine built from this flake without installing them by hand.
+
+## What Changes
+
+- Add `pkgs.firefox` and nixpkgs' current Bitwarden desktop client package (`pkgs.bitwarden-desktop` — the old `bitwarden` attribute was renamed upstream) to `modules/home/desktop-apps.nix`'s cross-platform app list, following the existing `lib.meta.availableOn` filtering pattern.
+- Add `pkgs.bitwarden-cli` to `modules/home/dev-tools.nix`'s CLI tool list, following the same pattern already used for `claude-code`.
+- No `lib/unfree-allowlist.nix` change: verified via `nix eval` against the flake's pinned `nixos-unstable` nixpkgs that `firefox` (MPL-2.0), `bitwarden-desktop` (GPL-3.0), and `bitwarden-cli` (GPL-3.0) are all free-licensed today, so `nixpkgs.config.allowUnfreePredicate` needs no new entries.
+- Explicitly **not** in scope (per user decision): no OS/XDG default-browser association (`xdg.mimeApps`) and no `programs.firefox` extension/policy management — Firefox extensions, including Bitwarden's, are expected to sync in via Firefox Sync login.
+- **BREAKING**: none — additive only.
+
+## Capabilities
+
+### New Capabilities
+(none)
+
+### Modified Capabilities
+- `desktop-applications`: add a requirement that Firefox and the Bitwarden desktop client are provisioned via the shared home profile alongside the existing Slack/Discord/Spotify/teams-for-linux apps.
+
+(`developer-environment` is unaffected at the requirement level: adding `bitwarden-cli` is already covered by its existing requirement that the shared profile "SHALL include the user's evidenced most-used CLI and client tools," the same reasoning used previously for `claude-code` — no requirement text changes needed.)
+
+## Impact
+
+- **Affected code**: `modules/home/desktop-apps.nix` (add firefox + bitwarden-desktop to `crossPlatformApps`), `modules/home/dev-tools.nix` (add bitwarden-cli to the CLI package list).
+- **Not affected**: `lib/unfree-allowlist.nix`, `lib/mkHome.nix`, `lib/mkNixos.nix` — all three new packages are free-licensed, so the existing `allowUnfreePredicate` wiring needs no changes.
+- **Dependencies**: nixpkgs' `firefox`, `bitwarden-desktop`, and `bitwarden-cli` packages (all already present in the pinned `nixos-unstable` input; no new flake inputs).
+- **Platforms**: all three packages have `aarch64-darwin` and `x86_64-linux`/`aarch64-linux` builds in nixpkgs today, so they're expected to be included on every currently-relevant target (`tom@linux`, `tom@darwin`) via the existing `lib.meta.availableOn` filter — no platform-specific gating (like teams-for-linux's Linux-only restriction) is needed for this change.
+- **Known limitation, out of scope**: no default-browser (XDG mime) or Firefox extension/policy management, by explicit user decision — see "What Changes".
diff --git a/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/specs/desktop-applications/spec.md b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/specs/desktop-applications/spec.md
new file mode 100644
index 0000000..f20659d
--- /dev/null
+++ b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/specs/desktop-applications/spec.md
@@ -0,0 +1,8 @@
+## MODIFIED Requirements
+
+### Requirement: Desktop GUI applications are provisioned via the shared home profile
+The shared home-manager profile SHALL include Slack, Discord, Spotify, teams-for-linux, Firefox, and the Bitwarden desktop client as GUI application packages, available wherever that profile is activated and the underlying package supports the current system.
+
+#### Scenario: GUI app available after activation
+- **WHEN** the shared home profile is activated on a system for which a given desktop application's package is supported
+- **THEN** that application is available without any additional manual installation step
diff --git a/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/tasks.md b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/tasks.md
new file mode 100644
index 0000000..fd8c418
--- /dev/null
+++ b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/tasks.md
@@ -0,0 +1,14 @@
+## 1. Add Firefox and Bitwarden desktop app to the shared home profile
+
+- [x] 1.1 In `modules/home/desktop-apps.nix`, add `pkgs.firefox` and `pkgs.bitwarden-desktop` to `crossPlatformApps` and verify `nix eval --impure --expr 'let pkgs = import <nixpkgs> {}; in [ pkgs.firefox pkgs.bitwarden-desktop ]'` resolves both packages without error.
+- [x] 1.2 Verify no `lib/unfree-allowlist.nix` change is needed by confirming `pkgs.firefox.meta.unfree` and `pkgs.bitwarden-desktop.meta.unfree` are both `false` against the flake's pinned nixpkgs (already confirmed during proposal against `nixos-unstable`; re-check if the flake lock has moved since).
+
+## 2. Add Bitwarden CLI to the shared developer tooling
+
+- [x] 2.1 In `modules/home/dev-tools.nix`, add `pkgs.bitwarden-cli` to the `home.packages` list (plain list entry, consistent with `gh`/`tmux`/etc. — no `lib.meta.availableOn` guard needed since `claude-code` is the only currently-gated entry and `bitwarden-cli` has broad platform support).
+
+## 3. Validate
+
+- [x] 3.1 Run `openspec validate add-firefox-bitwarden --strict` and confirm it passes.
+- [x] 3.2 Run `home-manager build --flake .#tom@linux` (or the equivalent for the platform available) and confirm the build succeeds with firefox, bitwarden-desktop, and bitwarden-cli present in the resulting profile's `home.packages`.
+- [x] 3.3 Run `nix flake check` and confirm it passes with no new evaluation errors.
diff --git a/openspec/specs/desktop-applications/spec.md b/openspec/specs/desktop-applications/spec.md
index 8e46afe..8758177 100644
--- a/openspec/specs/desktop-applications/spec.md
+++ b/openspec/specs/desktop-applications/spec.md
@@ -7,7 +7,7 @@ Provisions everyday desktop GUI applications (chat, communication, and music cli
 ## Requirements
 
 ### Requirement: Desktop GUI applications are provisioned via the shared home profile
-The shared home-manager profile SHALL include Slack, Discord, Spotify, and teams-for-linux as GUI application packages, available wherever that profile is activated and the underlying package supports the current system.
+The shared home-manager profile SHALL include Slack, Discord, Spotify, teams-for-linux, Firefox, and the Bitwarden desktop client as GUI application packages, available wherever that profile is activated and the underlying package supports the current system.
 
 #### Scenario: GUI app available after activation
 - **WHEN** the shared home profile is activated on a system for which a given desktop application's package is supported