bsmnt 0.6.3 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bsmnt",
-	"version": "0.6.3",
+	"version": "0.6.4",
 	"packageManager": "bun@1.3.14",
 	"description": "CLI to scaffold basement projects and add integrations",
 	"type": "module",

package/src/modules/features/env/dotenvx/files/save-key.mjs

@@ -4,7 +4,10 @@
 //   bun run env:save
 
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 const VAULT = "Development";
@@ -87,22 +90,34 @@ if (existing.status === 0) {
   );
 }
 
-// 5. Create the item. Category/title/tags must be flags (op ignores them in a
-// piped template); the key goes in the stdin template (`-` first) so it stays
-// off argv. The field needs an `id` or op drops it.
-const args = ["item", "create", "-", "--category", "Secure Note", "--title", title];
-if (tag) args.push("--tags", tag);
-args.push("--vault", VAULT, "--format", "json");
+// 5. Create the item from a temp template file (0600, unlinked after). Not stdin
+// — bun's spawnSync drops `input`, leaving an empty note; not assignments —
+// those leak the key into argv. The field needs an `id` or op drops it.
 const template = {
+  title,
+  category: "SECURE_NOTE",
+  ...(tag ? { tags: [tag] } : {}),
   fields: [
     { id: "private-key", type: "CONCEALED", label: "private-key", value: privateKey },
   ],
 };
-const created = spawnSync("op", args, {
-  input: JSON.stringify(template),
-  encoding: "utf-8",
-  stdio: ["pipe", "pipe", "inherit"],
-});
+const templatePath = join(tmpdir(), `bsmnt-op-${randomUUID()}.json`);
+let created;
+try {
+  // Inside the try so a partial write is still cleaned up by `finally`.
+  writeFileSync(templatePath, JSON.stringify(template), { mode: 0o600 });
+  created = spawnSync(
+    "op",
+    ["item", "create", "--template", templatePath, "--vault", VAULT, "--format", "json"],
+    { encoding: "utf-8", stdio: ["ignore", "pipe", "inherit"] },
+  );
+} finally {
+  try {
+    unlinkSync(templatePath);
+  } catch {
+    // best-effort cleanup
+  }
+}
 if (created.status !== 0) fail("\nFailed to create the 1Password item.");
 
 // 6. Reference the item by id (stable; survives renames), falling back to title.