bwx 0.1.0

package/src/cli/commands/config.ts

@@ -0,0 +1,103 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitSuccess } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { loadConfig, saveConfig } from "../../config/store.ts";
+
+export function registerConfig(program: Command): void {
+	const configCmd = program
+		.command("config")
+		.description("Manage bwx configuration");
+
+	configCmd
+		.command("email")
+		.description("Set Bitwarden account email")
+		.argument("[email]", "Account email address")
+		.action(async function (this: Command, email?: string) {
+			const opts = getGlobalOpts(this);
+
+			if (!email) {
+				if (!process.stdin.isTTY) {
+					throw new CliError(
+						"Pass email as argument when piping",
+						ExitCode.BadArgs,
+					);
+				}
+				process.stderr.write("Email: ");
+				email = await readLine();
+			}
+
+			if (!email) {
+				throw new CliError("Email is required", ExitCode.BadArgs);
+			}
+
+			const config = await loadConfig();
+			config.email = email;
+			await saveConfig(config);
+
+			emitSuccess("Email saved", opts);
+		});
+
+	configCmd
+		.command("master-password")
+		.description("Set master password in macOS Keychain")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+
+			let password: string;
+
+			if (process.stdin.isTTY) {
+				// Interactive prompt
+				process.stderr.write("Master password: ");
+				password = await readLine();
+			} else {
+				// Piped input
+				const chunks: Uint8Array[] = [];
+				for await (const chunk of Bun.stdin.stream()) {
+					chunks.push(chunk);
+				}
+				password = Buffer.concat(chunks).toString().trim();
+			}
+
+			if (!password) {
+				throw new CliError("No password provided", ExitCode.BadArgs);
+			}
+
+			const proc = Bun.spawn(
+				[
+					"security",
+					"add-generic-password",
+					"-a",
+					"bitwarden",
+					"-s",
+					"bitwarden-master",
+					"-U",
+					"-w",
+					password,
+				],
+				{ stdout: "pipe", stderr: "pipe" },
+			);
+
+			const stderr = await new Response(proc.stderr).text();
+			const exitCode = await proc.exited;
+
+			if (exitCode !== 0) {
+				throw new CliError(
+					`Failed to save to Keychain: ${stderr.trim()}`,
+					ExitCode.Config,
+				);
+			}
+
+			emitSuccess("Master password saved to Keychain", opts);
+		});
+}
+
+async function readLine(): Promise<string> {
+	const chunks: Uint8Array[] = [];
+	for await (const chunk of Bun.stdin.stream()) {
+		chunks.push(chunk);
+		const text = Buffer.concat(chunks).toString();
+		if (text.includes("\n")) return text.split("\n")[0]!.trim();
+	}
+	return Buffer.concat(chunks).toString().trim();
+}

package/src/cli/commands/create.ts

@@ -0,0 +1,133 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData, emitSuccess } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import { buildNewItem, parseFieldFlag, bwEncode } from "../../bw/encoding.ts";
+
+function collect(val: string, prev: string[]): string[] {
+	prev.push(val);
+	return prev;
+}
+
+export function registerCreate(program: Command): void {
+	program
+		.command("create")
+		.description("Create a new vault item")
+		.option("--type <type>", "Item type: login|note", "note")
+		.option("--name <name>", "Item name")
+		.option("--notes <text>", "Notes content")
+		.option("--username <user>", "Username (login type)")
+		.option("--password <pass>", "Password (login type)")
+		.option("--uri <url>", "URI (repeatable)", collect, [])
+		.option("--field <kv>", "Custom field k=v (repeatable)", collect, [])
+		.option("--folder <id>", "Folder ID")
+		.option("--favorite", "Mark as favorite")
+		.option("--from-json", "Read full item JSON from stdin")
+		.action(async function (
+			this: Command,
+			localOpts: {
+				type: string;
+				name?: string;
+				notes?: string;
+				username?: string;
+				password?: string;
+				uri: string[];
+				field: string[];
+				folder?: string;
+				favorite?: boolean;
+				fromJson?: boolean;
+			},
+		) {
+			const opts = getGlobalOpts(this);
+
+			let encoded: string;
+
+			if (localOpts.fromJson) {
+				const stdin = await readStdin();
+				if (!stdin) {
+					throw new CliError("No JSON provided on stdin", ExitCode.BadArgs);
+				}
+				// Validate it's JSON
+				try {
+					JSON.parse(stdin);
+				} catch {
+					throw new CliError("Invalid JSON on stdin", ExitCode.BadArgs);
+				}
+				encoded = bwEncode(stdin);
+			} else {
+				if (!localOpts.name) {
+					throw new CliError("--name is required", ExitCode.BadArgs);
+				}
+
+				if (localOpts.type !== "login" && localOpts.type !== "note") {
+					throw new CliError(
+						`Invalid type "${localOpts.type}". Valid: login, note`,
+						ExitCode.BadArgs,
+					);
+				}
+
+				// Read notes from stdin if not provided and not a TTY
+				let notes = localOpts.notes ?? null;
+				if (notes === null && !process.stdin.isTTY) {
+					const stdinText = await readStdin();
+					if (stdinText) notes = stdinText;
+				}
+
+				// Read password from stdin if not provided, login type, and not a TTY
+				let password = localOpts.password ?? null;
+				if (
+					password === null &&
+					localOpts.type === "login" &&
+					!process.stdin.isTTY &&
+					notes === null
+				) {
+					const stdinText = await readStdin();
+					if (stdinText) password = stdinText;
+				}
+
+				const fields = localOpts.field.map(parseFieldFlag);
+
+				const item = buildNewItem({
+					type: localOpts.type,
+					name: localOpts.name,
+					notes,
+					username: localOpts.username ?? null,
+					password,
+					uris: localOpts.uri,
+					fields,
+					folderId: localOpts.folder ?? null,
+					favorite: localOpts.favorite ?? false,
+				});
+
+				encoded = bwEncode(JSON.stringify(item));
+			}
+
+			const result = await withSession(opts, () =>
+				runBwOrThrow(["create", "item", encoded]),
+			);
+
+			const created = JSON.parse(result);
+			if (opts.json) {
+				emitData(created, opts);
+			} else if (opts.plain) {
+				emitData(created.id, opts);
+			} else {
+				emitSuccess(`Created "${created.name}" (${created.id})`, opts);
+			}
+		});
+}
+
+async function readStdin(): Promise<string | null> {
+	try {
+		const chunks: Uint8Array[] = [];
+		for await (const chunk of Bun.stdin.stream()) {
+			chunks.push(chunk);
+		}
+		const text = Buffer.concat(chunks).toString().trim();
+		return text || null;
+	} catch {
+		return null;
+	}
+}

package/src/cli/commands/delete.ts

@@ -0,0 +1,67 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData, emitSuccess } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import pc from "picocolors";
+
+export function registerDelete(program: Command): void {
+	program
+		.command("delete")
+		.description("Delete a vault item")
+		.argument("<item>", "Item name or ID")
+		.option("--permanent", "Permanently delete (no trash)")
+		.option("--force", "Skip confirmation prompt")
+		.action(async function (
+			this: Command,
+			item: string,
+			localOpts: { permanent?: boolean; force?: boolean },
+		) {
+			const opts = getGlobalOpts(this);
+
+			// Resolve item to get ID and name
+			const json = await withSession(opts, () =>
+				runBwOrThrow(["get", "item", item]),
+			);
+			const current = JSON.parse(json);
+			const itemId: string = current.id;
+			const itemName: string = current.name;
+
+			// Confirm unless --force, --json, or --plain
+			if (!localOpts.force && !opts.json && !opts.plain && process.stdin.isTTY) {
+				const label = localOpts.permanent ? "permanently delete" : "delete";
+				process.stderr.write(
+					`${pc.yellow("?")} ${label} "${itemName}" (${itemId})? [y/N] `,
+				);
+				const answer = await readLine();
+				if (answer.toLowerCase() !== "y") {
+					throw new CliError("Cancelled", ExitCode.UserCancelled);
+				}
+			}
+
+			const args = ["delete", "item", itemId];
+			if (localOpts.permanent) args.push("--permanent");
+
+			await withSession(opts, () => runBwOrThrow(args));
+
+			if (opts.json) {
+				emitData({ id: itemId, name: itemName, deleted: true }, opts);
+			} else if (opts.plain) {
+				emitData(itemId, opts);
+			} else {
+				const label = localOpts.permanent ? "Permanently deleted" : "Deleted";
+				emitSuccess(`${label} "${itemName}" (${itemId})`, opts);
+			}
+		});
+}
+
+async function readLine(): Promise<string> {
+	const chunks: Uint8Array[] = [];
+	for await (const chunk of Bun.stdin.stream()) {
+		chunks.push(chunk);
+		const text = Buffer.concat(chunks).toString();
+		if (text.includes("\n")) return text.split("\n")[0]!.trim();
+	}
+	return Buffer.concat(chunks).toString().trim();
+}

package/src/cli/commands/edit.ts

@@ -0,0 +1,93 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData, emitSuccess } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import { patchItem, parseFieldFlag, bwEncode } from "../../bw/encoding.ts";
+
+function collect(val: string, prev: string[]): string[] {
+	prev.push(val);
+	return prev;
+}
+
+export function registerEdit(program: Command): void {
+	program
+		.command("edit")
+		.description("Edit an existing vault item")
+		.argument("<item>", "Item name or ID")
+		.option("--name <name>", "New name")
+		.option("--notes <text>", "New notes")
+		.option("--username <user>", "New username")
+		.option("--password <pass>", "New password")
+		.option("--uri <url>", "Set URIs (repeatable, replaces all)", collect, [])
+		.option("--add-field <kv>", "Add/update field k=v", collect, [])
+		.option("--rm-field <name>", "Remove field by name", collect, [])
+		.option("--folder <id>", "Move to folder")
+		.option("--favorite", "Set favorite")
+		.option("--no-favorite", "Unset favorite")
+		.option("--from-json", "Read full item JSON from stdin (replaces item)")
+		.action(async function (
+			this: Command,
+			item: string,
+			localOpts: {
+				name?: string;
+				notes?: string;
+				username?: string;
+				password?: string;
+				uri: string[];
+				addField: string[];
+				rmField: string[];
+				folder?: string;
+				favorite?: boolean;
+				fromJson?: boolean;
+			},
+		) {
+			const opts = getGlobalOpts(this);
+
+			const result = await withSession(opts, async () => {
+				// Fetch current item
+				const json = await runBwOrThrow(["get", "item", item]);
+				const current = JSON.parse(json);
+				const itemId = current.id;
+
+				let encoded: string;
+
+				if (localOpts.fromJson) {
+					const chunks: Uint8Array[] = [];
+					for await (const chunk of Bun.stdin.stream()) {
+						chunks.push(chunk);
+					}
+					const stdinText = Buffer.concat(chunks).toString().trim();
+					if (!stdinText) {
+						throw new CliError("No JSON provided on stdin", ExitCode.BadArgs);
+					}
+					encoded = bwEncode(stdinText);
+				} else {
+					const patched = patchItem(current, {
+						name: localOpts.name,
+						notes: localOpts.notes,
+						username: localOpts.username,
+						password: localOpts.password,
+						uris: localOpts.uri.length > 0 ? localOpts.uri : undefined,
+						addFields: localOpts.addField.map(parseFieldFlag),
+						rmFields: localOpts.rmField,
+						folderId: localOpts.folder,
+						favorite: localOpts.favorite,
+					});
+					encoded = bwEncode(JSON.stringify(patched));
+				}
+
+				return runBwOrThrow(["edit", "item", itemId, encoded]);
+			});
+
+			const updated = JSON.parse(result);
+			if (opts.json) {
+				emitData(updated, opts);
+			} else if (opts.plain) {
+				emitData(updated.id, opts);
+			} else {
+				emitSuccess(`Updated "${updated.name}" (${updated.id})`, opts);
+			}
+		});
+}

package/src/cli/commands/field.ts

@@ -0,0 +1,36 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import { BwItemSchema } from "../../bw/types.ts";
+
+export function registerField(program: Command): void {
+	program
+		.command("field")
+		.description("Get a custom field from a vault item")
+		.argument("<item>", "Item name or ID")
+		.argument("<field-name>", "Custom field name")
+		.action(async function (this: Command, item: string, fieldName: string) {
+			const opts = getGlobalOpts(this);
+
+			const json = await withSession(opts, () =>
+				runBwOrThrow(["get", "item", item]),
+			);
+
+			const parsed = BwItemSchema.parse(JSON.parse(json));
+			const fields = parsed.fields ?? [];
+			const match = fields.find((f) => f.name === fieldName);
+
+			if (!match) {
+				const available = fields.map((f) => f.name).join(", ");
+				const msg = available
+					? `Field "${fieldName}" not found. Available: ${available}`
+					: `Field "${fieldName}" not found (item has no custom fields)`;
+				throw new CliError(msg, ExitCode.NotFound);
+			}
+
+			emitData(match.value ?? "", opts);
+		});
+}

package/src/cli/commands/get.ts

@@ -0,0 +1,47 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData } from "../io.ts";
+import { handleFatalError } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+
+const VALID_FIELDS = ["password", "username", "totp", "notes", "uri", "item"];
+
+export function registerGet(program: Command): void {
+	program
+		.command("get")
+		.description("Get a field from a vault item")
+		.argument("<field>", `Field: ${VALID_FIELDS.join(" | ")}`)
+		.argument("<item>", "Item name or ID")
+		.action(async function (this: Command, field: string, item: string) {
+			const opts = getGlobalOpts(this);
+
+			if (!VALID_FIELDS.includes(field)) {
+				throw new CliError(
+					`Invalid field "${field}". Valid: ${VALID_FIELDS.join(", ")}`,
+					ExitCode.BadArgs,
+				);
+			}
+
+			const result = await withSession(opts, async () => {
+				if (field === "item") {
+					return runBwOrThrow(["get", "item", item]);
+				}
+				return runBwOrThrow(["get", field, item]);
+			});
+
+			if (!result) {
+				throw new CliError(
+					`No ${field} found for item: ${item}`,
+					ExitCode.NotFound,
+				);
+			}
+
+			if (field === "item") {
+				emitData(JSON.parse(result), opts);
+			} else {
+				emitData(result, opts);
+			}
+		});
+}

package/src/cli/commands/lock.ts

@@ -0,0 +1,15 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitSuccess } from "../io.ts";
+import { lockVault } from "../../bw/session.ts";
+
+export function registerLock(program: Command): void {
+	program
+		.command("lock")
+		.description("Lock vault and clear cached session")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+			await lockVault();
+			emitSuccess("Vault locked", opts);
+		});
+}

package/src/cli/commands/search.ts

@@ -0,0 +1,85 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData } from "../io.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import { BW_TYPE_LABELS, BW_TYPE_FROM_NAME } from "../../bw/types.ts";
+import pc from "picocolors";
+
+export function registerSearch(program: Command): void {
+	program
+		.command("search")
+		.description("Search vault items")
+		.argument("<query>", "Search query")
+		.option("--type <type>", "Filter by type: login|note|card|identity")
+		.option("--folder <id>", "Filter by folder ID")
+		.option("--limit <n>", "Limit results", parseInt)
+		.action(async function (
+			this: Command,
+			query: string,
+			localOpts: { type?: string; folder?: string; limit?: number },
+		) {
+			const opts = getGlobalOpts(this);
+
+			const args = ["list", "items", "--search", query];
+			if (localOpts.folder) {
+				args.push("--folderid", localOpts.folder);
+			}
+
+			const json = await withSession(opts, () => runBwOrThrow(args));
+			let items: Array<Record<string, unknown>> = JSON.parse(json);
+
+			// Filter by type
+			if (localOpts.type) {
+				const typeVal = BW_TYPE_FROM_NAME[localOpts.type];
+				if (typeVal === undefined) {
+					throw new CliError(
+						`Invalid type "${localOpts.type}". Valid: login, note, card, identity`,
+						ExitCode.BadArgs,
+					);
+				}
+				items = items.filter((i) => i.type === typeVal);
+			}
+
+			// Limit
+			if (localOpts.limit && localOpts.limit > 0) {
+				items = items.slice(0, localOpts.limit);
+			}
+
+			if (items.length === 0) {
+				throw new CliError(
+					`No items matching "${query}"`,
+					ExitCode.NotFound,
+				);
+			}
+
+			if (opts.json) {
+				emitData(items, opts);
+				return;
+			}
+
+			if (opts.plain) {
+				for (const item of items) {
+					const type = BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
+					const login = item.login as Record<string, unknown> | null;
+					const username = login?.username ?? "-";
+					process.stdout.write(
+						`${item.id}\t${type}\t${item.name}\t${username}\n`,
+					);
+				}
+				return;
+			}
+
+			// Human-friendly table
+			for (const item of items) {
+				const type = BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
+				const login = item.login as Record<string, unknown> | null;
+				const username = login?.username ?? "";
+				const userPart = username ? pc.dim(` (${username})`) : "";
+				process.stdout.write(
+					`${pc.dim(item.id as string)}  ${pc.cyan(type)}  ${item.name}${userPart}\n`,
+				);
+			}
+		});
+}

package/src/cli/commands/status.ts

@@ -0,0 +1,36 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitData } from "../io.ts";
+import { getStatus } from "../../bw/session.ts";
+import { BW_TYPE_LABELS } from "../../bw/types.ts";
+import pc from "picocolors";
+
+export function registerStatus(program: Command): void {
+	program
+		.command("status")
+		.description("Show vault status (no auto-unlock)")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+			const status = await getStatus();
+
+			if (opts.json || opts.plain) {
+				emitData(status, opts);
+				return;
+			}
+
+			const statusColor =
+				status.status === "unlocked"
+					? pc.green
+					: status.status === "locked"
+						? pc.yellow
+						: pc.red;
+
+			const lines = [
+				`${pc.dim("Status:")}  ${statusColor(status.status)}`,
+				`${pc.dim("Email:")}   ${status.userEmail ?? "-"}`,
+				`${pc.dim("Server:")}  ${status.serverUrl ?? "-"}`,
+				`${pc.dim("Synced:")}  ${status.lastSync ?? "never"}`,
+			];
+			process.stdout.write(lines.join("\n") + "\n");
+		});
+}

package/src/cli/commands/sync.ts

@@ -0,0 +1,16 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitSuccess } from "../io.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+
+export function registerSync(program: Command): void {
+	program
+		.command("sync")
+		.description("Sync vault (auto-unlocks)")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+			await withSession(opts, () => runBwOrThrow(["sync"]));
+			emitSuccess("Vault synced", opts);
+		});
+}

package/src/cli/commands/unlock.ts

@@ -0,0 +1,15 @@
+import type { Command } from "commander";
+import { getGlobalOpts } from "../program.ts";
+import { emitSuccess } from "../io.ts";
+import { ensureUnlocked } from "../../bw/session.ts";
+
+export function registerUnlock(program: Command): void {
+	program
+		.command("unlock")
+		.description("Unlock vault (caches session)")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+			await ensureUnlocked(opts);
+			emitSuccess("Vault unlocked", opts);
+		});
+}

package/src/cli/errors.ts

@@ -0,0 +1,40 @@
+export const ExitCode = {
+	OK: 0,
+	Unknown: 1,
+	BadArgs: 2,
+	AuthFailed: 3,
+	NotFound: 4,
+	BwError: 5,
+	Network: 6,
+	Config: 7,
+	Timeout: 8,
+	UserCancelled: 9,
+} as const;
+
+export type ExitCode = (typeof ExitCode)[keyof typeof ExitCode];
+
+export class CliError extends Error {
+	constructor(
+		message: string,
+		public readonly exitCode: ExitCode = ExitCode.Unknown,
+	) {
+		super(message);
+		this.name = "CliError";
+	}
+}
+
+const BW_STDERR_PATTERNS: Array<[RegExp, ExitCode]> = [
+	[/not logged in|unauthenticated/i, ExitCode.AuthFailed],
+	[/vault is locked/i, ExitCode.AuthFailed],
+	[/not found/i, ExitCode.NotFound],
+	[/more than one result/i, ExitCode.BadArgs],
+	[/timed? ?out/i, ExitCode.Timeout],
+	[/network|ECONNREFUSED|ENOTFOUND/i, ExitCode.Network],
+];
+
+export function classifyBwError(stderr: string): ExitCode {
+	for (const [pattern, code] of BW_STDERR_PATTERNS) {
+		if (pattern.test(stderr)) return code;
+	}
+	return ExitCode.BwError;
+}