feat(config): support additional 2026.7 client flags

Co-Authored-By: GPT-5.6 <noreply@openai.com>

.env.template

@@ -382,14 +382,19 @@
 ##
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in the Safari browser extension. (Verified in Browser 2026.7.0)
+## - "pm-32413-multi-client-password-management": Enable this authentication-sensitive client rollout. (Verified in Browser/Desktop 2026.7.0)
+## - "pm-4516-devices-add-last-activity-date": Show device last activity when supplied by the server. Vaultwarden does not currently supply this field. (Verified in Browser/Desktop 2026.7.0)
 ## - "undetermined-cipher-scenario-logic": Enable the browser extension's updated autofill matching logic. (Verified in Browser 2026.7.0)
 ## - "macos-native-credential-sync": Enable native macOS credential-provider sync in Desktop. (Verified in Desktop 2026.7.0)
 ## - "fill-assist-targeting-rules": Enable Fill Assist targeting rules for autofill. (Verified in Browser/Android/iOS 2026.7.0)
 ## - "pm-39071-default-password-manager-prompt": Prompt new browser-extension installations to make Bitwarden the default password manager. (Verified in Browser 2026.7.0)
+## - "pm-29968-fill-after-save": Fill matching logins after saving them. (Verified in Browser 2026.7.0)
+## - "content-script-ipc-channel-framework": Enable this internal/experimental client rollout. (Verified in Browser 2026.7.0)
 ## - "windows-desktop-autotype": Enable Windows Desktop auto-type for Premium accounts. (Verified in Desktop 2026.7.0)
 ## - "windows-desktop-autotype-ga": Show Windows Desktop auto-type controls; also enable "windows-desktop-autotype". (Verified in Desktop 2026.7.0)
 ## - "ssh-agent-v2": Enable the current SSH agent implementation in Desktop. (Verified in Desktop 2026.7.0)
 ## - "ssh-ecdsa": Allow importing supported ECDSA SSH keys in Desktop; also enable "ssh-agent-v2". (Verified in Desktop 2026.7.0)
+## - "pm-32783-electron-storage-cache": Enable this internal/experimental client rollout. (Verified in Desktop 2026.7.0)
 ## - "desktop-ui-settings-dialog": Use the Desktop settings dialog. (Verified in Desktop 2026.7.0)
 ## - "innovation-sprint-shared-unlock-part-1": Enable the shared-unlock Desktop/Browser leader. Must be enabled with part 2.
 ## - "innovation-sprint-shared-unlock-part-2": Enable the shared-unlock Browser/Web follower and controls. Must be enabled with part 1.
@@ -397,6 +402,12 @@
 ## - "pm-30529-webauthn-related-origins": Allow passkey operations across domains a site declares as related. (Verified in Browser 2026.7.0)
 ## - "pm-34410-attachment-upload-progress": Show attachment upload progress in supported clients. (Verified in Browser/Desktop 2026.7.0)
 ## - "phishing-detection": Warn in the browser extension when a visited site matches its phishing data. (Verified in Browser 2026.7.0)
+## - "pm-37785-vault-batch-bar": Enable the Vault batch bar. Both batch-bar flags are required for Desktop. (Verified in Browser/Desktop 2026.7.0)
+## - "pm-37785-desktop-vault-batch-bar": Enable the Desktop Vault batch bar. Both batch-bar flags are required for Desktop. (Verified in Desktop 2026.7.0)
+## - "pm-31039-item-action-in-extension": Show item actions in the browser extension. (Verified in Browser 2026.7.0)
+## - "pm-32380-btn-text-add-create": Use Add/Create button text. (Verified in Browser/Desktop 2026.7.0)
+## - "pm-28091-add-copy-and-quick-launch-actions": Add Copy and Quick Launch actions. (Verified in Browser/Desktop 2026.7.0)
+## - "pm-32016-remove-at-risk-callout": Suppress the at-risk password callout. (Verified in Browser/Desktop 2026.7.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.

src/config.rs

@@ -1416,16 +1416,21 @@ pub enum PathType {
 pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     // Auth Team
     "pm-5594-safari-account-switching",
+    "pm-32413-multi-client-password-management",
+    "pm-4516-devices-add-last-activity-date",
     // Autofill Team
     "undetermined-cipher-scenario-logic",
     "macos-native-credential-sync",
     "fill-assist-targeting-rules",
     "pm-39071-default-password-manager-prompt",
+    "pm-29968-fill-after-save",
+    "content-script-ipc-channel-framework",
     // Desktop Native Team
     "windows-desktop-autotype",
     "windows-desktop-autotype-ga",
     "ssh-agent-v2",
     "ssh-ecdsa",
+    "pm-32783-electron-storage-cache",
     // Desktop Team
     "desktop-ui-settings-dialog",
     // Key Management Team
@@ -1438,6 +1443,13 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "pm-34410-attachment-upload-progress",
     // DIRT Team
     "phishing-detection",
+    // Vault Team
+    "pm-37785-vault-batch-bar",
+    "pm-37785-desktop-vault-batch-bar",
+    "pm-31039-item-action-in-extension",
+    "pm-32380-btn-text-add-create",
+    "pm-28091-add-copy-and-quick-launch-actions",
+    "pm-32016-remove-at-risk-callout",
 ];
 
 impl Config {

src/util.rs

@@ -835,6 +835,31 @@ mod feature_flag_tests {
             ]),
         );
     }
+
+    #[test]
+    fn additional_2026_7_client_feature_flags_are_supported() {
+        let flags = parse_experimental_client_feature_flags(
+            "pm-37785-vault-batch-bar,pm-37785-desktop-vault-batch-bar,pm-31039-item-action-in-extension,pm-29968-fill-after-save,pm-32380-btn-text-add-create,pm-28091-add-copy-and-quick-launch-actions,pm-32016-remove-at-risk-callout,pm-32783-electron-storage-cache,content-script-ipc-channel-framework,pm-32413-multi-client-password-management,pm-4516-devices-add-last-activity-date",
+            &FeatureFlagFilter::ValidOnly,
+        );
+
+        assert_eq!(
+            flags,
+            HashMap::from([
+                ("pm-37785-vault-batch-bar".to_owned(), true),
+                ("pm-37785-desktop-vault-batch-bar".to_owned(), true),
+                ("pm-31039-item-action-in-extension".to_owned(), true),
+                ("pm-29968-fill-after-save".to_owned(), true),
+                ("pm-32380-btn-text-add-create".to_owned(), true),
+                ("pm-28091-add-copy-and-quick-launch-actions".to_owned(), true),
+                ("pm-32016-remove-at-risk-callout".to_owned(), true),
+                ("pm-32783-electron-storage-cache".to_owned(), true),
+                ("content-script-ipc-channel-framework".to_owned(), true),
+                ("pm-32413-multi-client-password-management".to_owned(), true),
+                ("pm-4516-devices-add-last-activity-date".to_owned(), true),
+            ]),
+        );
+    }
 }
 
 /// TODO: This is extracted from IpAddr::is_global, which is unstable: