bwx 0.2.2 → 0.4.0

package/src/bw/session.ts

@@ -1,58 +1,41 @@
+import { unlinkSync } from "node:fs";
 import { CliError, ExitCode } from "../cli/errors.ts";
 import type { GlobalOptions } from "../cli/types.ts";
-import { emitLog } from "../cli/io.ts";
-import {
-	runBw,
-	runBwOrThrow,
-	setSession,
-	getSession,
-	isAuthError,
-	type BwResult,
-} from "./runner.ts";
-import { BwStatusSchema, type BwStatus } from "./types.ts";
+import { emitLog, emitWarn } from "../cli/io.ts";
+import { SESSION_FILE } from "../config/paths.ts";
+import { readPrivateFile, writePrivateFile } from "../config/secure-file.ts";
+import { runBw, runBwOrThrow, setSession, getSession } from "./runner.ts";
+import { checkVaultFreshness } from "./freshness.ts";
+import { getStatus } from "./status.ts";
+import { BwStatusSchema } from "./types.ts";
 import { loadConfig } from "../config/store.ts";
 
-const SESSION_PATH = `${process.env.HOME}/.config/bwx/session`;
-
-async function loadCachedSession(): Promise<string | null> {
-	try {
-		const token = await Bun.file(SESSION_PATH).text();
-		return token.trim() || null;
-	} catch {
+/**
+ * Loads the cached session, ignoring a cache file that another user could have
+ * planted or read. Rejection is not fatal: the caller just unlocks again.
+ */
+function loadCachedSession(opts: GlobalOptions): string | null {
+	const read = readPrivateFile(SESSION_FILE);
+	if (read.kind === "rejected") {
+		emitWarn(`Ignoring cached session: ${read.reason}`, opts);
 		return null;
 	}
+	if (read.kind === "missing") return null;
+	return read.text.trim() || null;
 }
 
-async function saveCachedSession(token: string): Promise<void> {
-	const dir = SESSION_PATH.replace(/\/[^/]+$/, "");
-	const { mkdirSync } = await import("node:fs");
-	mkdirSync(dir, { recursive: true });
-	await Bun.write(SESSION_PATH, token);
-	const proc = Bun.spawn(["chmod", "600", SESSION_PATH]);
-	await proc.exited;
+function saveCachedSession(token: string): void {
+	writePrivateFile(SESSION_FILE, token);
 }
 
-async function clearCachedSession(): Promise<void> {
+function clearCachedSession(): void {
 	try {
-		const { unlinkSync } = await import("node:fs");
-		unlinkSync(SESSION_PATH);
+		unlinkSync(SESSION_FILE);
 	} catch {
 		// Already gone
 	}
 }
 
-export async function getStatus(): Promise<BwStatus> {
-	const result = await runBw(["status"], { session: null });
-	try {
-		return BwStatusSchema.parse(JSON.parse(result.stdout));
-	} catch {
-		throw new CliError(
-			`Failed to parse bw status: ${result.stdout}`,
-			ExitCode.BwError,
-		);
-	}
-}
-
 async function getMasterPassword(): Promise<string> {
 	const proc = Bun.spawn(
 		[
@@ -77,11 +60,9 @@ async function getMasterPassword(): Promise<string> {
 	return pw;
 }
 
-export async function ensureUnlocked(
-	opts: GlobalOptions,
-): Promise<void> {
+export async function ensureUnlocked(opts: GlobalOptions): Promise<void> {
 	// Try cached session first
-	const cached = getSession() || (await loadCachedSession());
+	const cached = getSession() || loadCachedSession(opts);
 	if (cached) {
 		setSession(cached);
 		// Quick check — try a lightweight command
@@ -114,17 +95,9 @@ export async function ensureUnlocked(
 		const pw = await getMasterPassword();
 		emitLog("Logging in...", opts);
 		const loginResult = await runBw(
-			[
-				"login",
-				config.email,
-				"--passwordenv",
-				"BW_MASTER_PW",
-				"--quiet",
-			],
-			{
-				session: null,
-				env: { BW_MASTER_PW: pw, BW_NOINTERACTION: "true" },
-			},
+			["login", config.email, "--passwordenv", "BW_MASTER_PW", "--quiet"],
+			// BW_NOINTERACTION is set for every bw call by the runner.
+			{ session: null, env: { BW_MASTER_PW: pw } },
 		);
 		if (loginResult.exitCode !== 0) {
 			throw new CliError(
@@ -150,35 +123,57 @@ export async function ensureUnlocked(
 
 	const token = unlockResult.stdout;
 	setSession(token);
-	await saveCachedSession(token);
+	saveCachedSession(token);
 }
 
 export async function lockVault(): Promise<void> {
 	await runBw(["lock"], { session: null });
 	setSession(null);
-	await clearCachedSession();
+	clearCachedSession();
+}
+
+interface SessionOptions {
+	/**
+	 * Skips the stale-vault check. Set by operations that own vault freshness
+	 * themselves (`sync`) to avoid recursion.
+	 */
+	skipFreshnessCheck?: boolean;
 }
 
 export async function withSession<T>(
 	opts: GlobalOptions,
 	fn: () => Promise<T>,
+	options?: SessionOptions,
 ): Promise<T> {
 	// Try with current/cached session
-	const cached = getSession() || (await loadCachedSession());
+	const cached = getSession() || loadCachedSession(opts);
 	if (cached) {
 		setSession(cached);
 	}
 
+	if (!options?.skipFreshnessCheck) {
+		await checkVaultFreshness(opts, () => syncVault(opts));
+	}
+
+	return withAuthRetry(opts, fn);
+}
+
+async function syncVault(opts: GlobalOptions): Promise<void> {
+	await withAuthRetry(opts, () => runBwOrThrow(["sync"]));
+}
+
+/** Runs `fn`, re-authenticating once if the cached session turned out to be stale. */
+async function withAuthRetry<T>(
+	opts: GlobalOptions,
+	fn: () => Promise<T>,
+): Promise<T> {
 	try {
 		return await fn();
 	} catch (err) {
-		if (
-			err instanceof CliError &&
-			err.exitCode === ExitCode.AuthFailed
-		) {
+		if (err instanceof CliError && err.exitCode === ExitCode.AuthFailed) {
 			// Clear stale session and re-auth
 			setSession(null);
-			await clearCachedSession();
+			clearCachedSession();
 			await ensureUnlocked(opts);
 			return await fn();
 		}

package/src/bw/status.ts

@@ -0,0 +1,19 @@
+import { CliError, ExitCode } from "../cli/errors.ts";
+import { runBw } from "./runner.ts";
+import { BwStatusSchema, type BwStatus } from "./types.ts";
+
+/**
+ * Reads the vault state. Deliberately runs without a session so the result
+ * reflects the vault itself rather than our cached unlock.
+ */
+export async function getStatus(): Promise<BwStatus> {
+	const result = await runBw(["status"], { session: null });
+	try {
+		return BwStatusSchema.parse(JSON.parse(result.stdout));
+	} catch {
+		throw new CliError(
+			`Failed to parse bw status: ${result.stdout}`,
+			ExitCode.BwError,
+		);
+	}
+}

package/src/cli/commands/attach.ts

@@ -0,0 +1,112 @@
+import type { Command } from "commander";
+import pc from "picocolors";
+import { listAttachments, resolveAttachment } from "../../bw/attachments.ts";
+import { runBwOrThrow } from "../../bw/runner.ts";
+import { withSession } from "../../bw/session.ts";
+import { emitData, emitSuccess } from "../io.ts";
+import { getGlobalOpts } from "../program.ts";
+
+export function registerAttach(program: Command): void {
+	const attach = program
+		.command("attach")
+		.aliases(["attachment", "attachments"])
+		.description("List and download item attachments");
+
+	attach
+		.command("list")
+		.alias("ls")
+		.description("List attachments for an item")
+		.argument("<item>", "Item name or ID")
+		.action(async function (this: Command, item: string) {
+			const opts = getGlobalOpts(this);
+			const current = await getItem(item, opts);
+			const attachments = listAttachments(current);
+
+			if (opts.json) {
+				emitData(attachments, opts);
+				return;
+			}
+
+			if (opts.plain) {
+				for (const attachment of attachments) {
+					process.stdout.write(
+						[
+							attachment.id,
+							attachment.fileName,
+							attachment.sizeName ?? attachment.size ?? "-",
+						].join("\t") + "\n",
+					);
+				}
+				return;
+			}
+
+			if (attachments.length === 0) {
+				const itemName = typeof current.name === "string" ? current.name : item;
+				process.stdout.write(`No attachments on "${itemName}"\n`);
+				return;
+			}
+
+			for (const attachment of attachments) {
+				const size = attachment.sizeName ?? attachment.size;
+				const sizePart = size === undefined ? "" : pc.dim(` (${size})`);
+				process.stdout.write(
+					`${pc.dim(attachment.id)}  ${attachment.fileName}${sizePart}\n`,
+				);
+			}
+		});
+
+	attach
+		.command("get")
+		.description("Download an attachment from an item")
+		.argument("<item>", "Item name or ID")
+		.argument("<attachment>", "Attachment ID or filename")
+		.option("-o, --output <path>", "Output file or directory")
+		.action(async function (
+			this: Command,
+			item: string,
+			attachmentQuery: string,
+			localOpts: { output?: string },
+		) {
+			const opts = getGlobalOpts(this);
+			const current = await getItem(item, opts);
+			const attachments = listAttachments(current);
+			const attachment = resolveAttachment(attachments, attachmentQuery);
+			const itemId = String(current.id);
+			const output = localOpts.output ?? attachment.fileName;
+
+			await withSession(opts, () =>
+				runBwOrThrow([
+					"get",
+					"attachment",
+					attachment.id,
+					"--itemid",
+					itemId,
+					"--output",
+					output,
+				]),
+			);
+
+			const result = {
+				itemId,
+				attachmentId: attachment.id,
+				fileName: attachment.fileName,
+				output,
+			};
+
+			if (opts.json) {
+				emitData(result, opts);
+			} else if (opts.plain) {
+				emitData(output, opts);
+			} else {
+				emitSuccess(`Saved "${attachment.fileName}" to ${output}`, opts);
+			}
+		});
+}
+
+async function getItem(
+	item: string,
+	opts: ReturnType<typeof getGlobalOpts>,
+): Promise<Record<string, unknown>> {
+	const json = await withSession(opts, () => runBwOrThrow(["get", "item", item]));
+	return JSON.parse(json) as Record<string, unknown>;
+}

package/src/cli/commands/create.ts

@@ -4,11 +4,29 @@ import { emitData, emitSuccess } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
-import { buildNewItem, parseFieldFlag, bwEncode } from "../../bw/encoding.ts";
+import { buildNewItem, bwEncode } from "../../bw/encoding.ts";
+import {
+	assertSingleStdinSource,
+	collect,
+	listExplicitStdinInputs,
+	readOptionalStdin,
+	resolveFieldSources,
+	resolveItemTextInputs,
+	StdinReader,
+	type ItemTextInputs,
+} from "../input.ts";
 
-function collect(val: string, prev: string[]): string[] {
-	prev.push(val);
-	return prev;
+interface CreateOptions extends ItemTextInputs {
+	type: string;
+	name?: string;
+	username?: string;
+	uri: string[];
+	field: string[];
+	fieldFile: string[];
+	fieldEnv: string[];
+	folder?: string;
+	favorite?: boolean;
+	fromJson?: boolean;
 }
 
 export function registerCreate(program: Command): void {
@@ -18,44 +36,40 @@ export function registerCreate(program: Command): void {
 		.option("--type <type>", "Item type: login|note", "note")
 		.option("--name <name>", "Item name")
 		.option("--notes <text>", "Notes content")
+		.option("--notes-file <path>", "Read notes from file (use - for stdin)")
 		.option("--username <user>", "Username (login type)")
 		.option("--password <pass>", "Password (login type)")
+		.option("--password-stdin", "Read password from stdin")
+		.option("--password-file <path>", "Read password from file (use - for stdin)")
+		.option("--password-env <name>", "Read password from environment variable")
 		.option("--uri <url>", "URI (repeatable)", collect, [])
 		.option("--field <kv>", "Custom field k=v (repeatable)", collect, [])
+		.option("--field-file <kv>", "Custom field value from file k=path (repeatable)", collect, [])
+		.option("--field-env <kv>", "Custom field value from env var k=ENV (repeatable)", collect, [])
 		.option("--folder <id>", "Folder ID")
 		.option("--favorite", "Mark as favorite")
 		.option("--from-json", "Read full item JSON from stdin")
 		.action(async function (
 			this: Command,
-			localOpts: {
-				type: string;
-				name?: string;
-				notes?: string;
-				username?: string;
-				password?: string;
-				uri: string[];
-				field: string[];
-				folder?: string;
-				favorite?: boolean;
-				fromJson?: boolean;
-			},
+			localOpts: CreateOptions,
 		) {
 			const opts = getGlobalOpts(this);
+			const stdin = new StdinReader();
 
 			let encoded: string;
 
 			if (localOpts.fromJson) {
-				const stdin = await readStdin();
-				if (!stdin) {
+				const stdinText = await stdin.read();
+				if (!stdinText) {
 					throw new CliError("No JSON provided on stdin", ExitCode.BadArgs);
 				}
 				// Validate it's JSON
 				try {
-					JSON.parse(stdin);
+					JSON.parse(stdinText);
 				} catch {
 					throw new CliError("Invalid JSON on stdin", ExitCode.BadArgs);
 				}
-				encoded = bwEncode(stdin);
+				encoded = bwEncode(stdinText);
 			} else {
 				if (!localOpts.name) {
 					throw new CliError("--name is required", ExitCode.BadArgs);
@@ -68,33 +82,41 @@ export function registerCreate(program: Command): void {
 					);
 				}
 
-				// Read notes from stdin if not provided and not a TTY
-				let notes = localOpts.notes ?? null;
-				if (notes === null && !process.stdin.isTTY) {
-					const stdinText = await readStdin();
-					if (stdinText) notes = stdinText;
-				}
+				const explicitStdinSources = listExplicitStdinInputs({
+					...localOpts,
+					fieldFileFlag: "--field-file",
+					fieldFiles: localOpts.fieldFile,
+				});
+				assertSingleStdinSource(explicitStdinSources);
+
+				const textInputs = await resolveItemTextInputs(localOpts, stdin);
+				let notes = textInputs.notes;
 
-				// Read password from stdin if not provided, login type, and not a TTY
-				let password = localOpts.password ?? null;
+				// Backward compatibility: piped create input becomes note content.
 				if (
-					password === null &&
-					localOpts.type === "login" &&
-					!process.stdin.isTTY &&
-					notes === null
+					notes === undefined &&
+					textInputs.password === undefined &&
+					explicitStdinSources.length === 0 &&
+					!process.stdin.isTTY
 				) {
-					const stdinText = await readStdin();
-					if (stdinText) password = stdinText;
+					notes = (await readOptionalStdin(stdin)) ?? undefined;
 				}
 
-				const fields = localOpts.field.map(parseFieldFlag);
+				const fields = await resolveFieldSources({
+					inline: localOpts.field,
+					file: localOpts.fieldFile,
+					env: localOpts.fieldEnv,
+					fileFlag: "--field-file",
+					envFlag: "--field-env",
+					stdin,
+				});
 
 				const item = buildNewItem({
 					type: localOpts.type,
 					name: localOpts.name,
-					notes,
+					notes: notes ?? null,
 					username: localOpts.username ?? null,
-					password,
+					password: textInputs.password ?? null,
 					uris: localOpts.uri,
 					fields,
 					folderId: localOpts.folder ?? null,
@@ -118,16 +140,3 @@ export function registerCreate(program: Command): void {
 			}
 		});
 }
-
-async function readStdin(): Promise<string | null> {
-	try {
-		const chunks: Uint8Array[] = [];
-		for await (const chunk of Bun.stdin.stream()) {
-			chunks.push(chunk);
-		}
-		const text = Buffer.concat(chunks).toString().trim();
-		return text || null;
-	} catch {
-		return null;
-	}
-}

package/src/cli/commands/doctor.ts

@@ -2,6 +2,7 @@ import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitData } from "../io.ts";
 import { loadConfig } from "../../config/store.ts";
+import { CONFIG_DIR } from "../../config/paths.ts";
 import pc from "picocolors";
 
 interface Check {
@@ -140,9 +141,7 @@ async function checkMasterPassword(): Promise<Check> {
 }
 
 async function checkConfigDir(): Promise<Check> {
-	const configDir =
-		process.env.XDG_CONFIG_HOME ?? `${process.env.HOME}/.config`;
-	const dir = `${configDir}/bwx`;
+	const dir = CONFIG_DIR;
 	try {
 		const { accessSync, constants } = await import("node:fs");
 		accessSync(dir, constants.W_OK);

package/src/cli/commands/edit.ts

@@ -4,11 +4,28 @@ import { emitData, emitSuccess } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
-import { patchItem, parseFieldFlag, bwEncode } from "../../bw/encoding.ts";
+import { patchItem, bwEncode } from "../../bw/encoding.ts";
+import {
+	assertSingleStdinSource,
+	collect,
+	listExplicitStdinInputs,
+	resolveFieldSources,
+	resolveItemTextInputs,
+	StdinReader,
+	type ItemTextInputs,
+} from "../input.ts";
 
-function collect(val: string, prev: string[]): string[] {
-	prev.push(val);
-	return prev;
+interface EditOptions extends ItemTextInputs {
+	name?: string;
+	username?: string;
+	uri: string[];
+	addField: string[];
+	addFieldFile: string[];
+	addFieldEnv: string[];
+	rmField: string[];
+	folder?: string;
+	favorite?: boolean;
+	fromJson?: boolean;
 }
 
 export function registerEdit(program: Command): void {
@@ -18,10 +35,16 @@ export function registerEdit(program: Command): void {
 		.argument("<item>", "Item name or ID")
 		.option("--name <name>", "New name")
 		.option("--notes <text>", "New notes")
+		.option("--notes-file <path>", "Read notes from file (use - for stdin)")
 		.option("--username <user>", "New username")
 		.option("--password <pass>", "New password")
+		.option("--password-stdin", "Read password from stdin")
+		.option("--password-file <path>", "Read password from file (use - for stdin)")
+		.option("--password-env <name>", "Read password from environment variable")
 		.option("--uri <url>", "Set URIs (repeatable, replaces all)", collect, [])
 		.option("--add-field <kv>", "Add/update field k=v", collect, [])
+		.option("--add-field-file <kv>", "Add/update field value from file k=path", collect, [])
+		.option("--add-field-env <kv>", "Add/update field value from env var k=ENV", collect, [])
 		.option("--rm-field <name>", "Remove field by name", collect, [])
 		.option("--folder <id>", "Move to folder")
 		.option("--favorite", "Set favorite")
@@ -30,20 +53,10 @@ export function registerEdit(program: Command): void {
 		.action(async function (
 			this: Command,
 			item: string,
-			localOpts: {
-				name?: string;
-				notes?: string;
-				username?: string;
-				password?: string;
-				uri: string[];
-				addField: string[];
-				rmField: string[];
-				folder?: string;
-				favorite?: boolean;
-				fromJson?: boolean;
-			},
+			localOpts: EditOptions,
 		) {
 			const opts = getGlobalOpts(this);
+			const stdin = new StdinReader();
 
 			const result = await withSession(opts, async () => {
 				// Fetch current item
@@ -54,23 +67,38 @@ export function registerEdit(program: Command): void {
 				let encoded: string;
 
 				if (localOpts.fromJson) {
-					const chunks: Uint8Array[] = [];
-					for await (const chunk of Bun.stdin.stream()) {
-						chunks.push(chunk);
-					}
-					const stdinText = Buffer.concat(chunks).toString().trim();
+					const stdinText = await stdin.read();
 					if (!stdinText) {
 						throw new CliError("No JSON provided on stdin", ExitCode.BadArgs);
 					}
 					encoded = bwEncode(stdinText);
 				} else {
+					assertSingleStdinSource(
+						listExplicitStdinInputs({
+							...localOpts,
+							fieldFileFlag: "--add-field-file",
+							fieldFiles: localOpts.addFieldFile,
+						}),
+					);
+
+					const textInputs = await resolveItemTextInputs(localOpts, stdin);
+
+					const addFields = await resolveFieldSources({
+						inline: localOpts.addField,
+						file: localOpts.addFieldFile,
+						env: localOpts.addFieldEnv,
+						fileFlag: "--add-field-file",
+						envFlag: "--add-field-env",
+						stdin,
+					});
+
 					const patched = patchItem(current, {
 						name: localOpts.name,
-						notes: localOpts.notes,
+						notes: textInputs.notes,
 						username: localOpts.username,
-						password: localOpts.password,
+						password: textInputs.password,
 						uris: localOpts.uri.length > 0 ? localOpts.uri : undefined,
-						addFields: localOpts.addField.map(parseFieldFlag),
+						addFields,
 						rmFields: localOpts.rmField,
 						folderId: localOpts.folder,
 						favorite: localOpts.favorite,