bwx 0.2.2 → 0.4.0

package/src/cli/commands/get.ts

@@ -1,13 +1,7 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitData } from "../io.ts";
-import { CliError, ExitCode } from "../errors.ts";
-import { runBwOrThrow } from "../../bw/runner.ts";
-import { withSession } from "../../bw/session.ts";
-import { BW_TYPE_LABELS, BwItemSchema } from "../../bw/types.ts";
-import pc from "picocolors";
-
-const BUILTIN_FIELDS = ["password", "username", "totp", "notes", "uri", "item"];
+import { readItemField } from "../../bw/fields.ts";
 
 export function registerGet(program: Command): void {
 	program
@@ -17,126 +11,18 @@ export function registerGet(program: Command): void {
 		.argument("<item>", "Item name or ID")
 		.action(async function (this: Command, field: string, item: string) {
 			const opts = getGlobalOpts(this);
-
-			if (BUILTIN_FIELDS.includes(field)) {
-				await getBuiltinField(field, item, opts);
-			} else {
-				await getCustomField(field, item, opts);
-			}
+			const value = await readItemField(field, item, opts);
+			// `item` is the one field that is itself JSON — emit it as structure.
+			emitData(field === "item" ? JSON.parse(value) : value, opts);
 		});
-}
 
-async function getBuiltinField(
-	field: string,
-	item: string,
-	opts: ReturnType<typeof getGlobalOpts>,
-): Promise<void> {
-	try {
-		const result = await withSession(opts, async () => {
-			if (field === "item") {
-				return runBwOrThrow(["get", "item", item]);
-			}
-			return runBwOrThrow(["get", field, item]);
+	program
+		.command("field")
+		.description("Get a custom field from a vault item")
+		.argument("<item>", "Item name or ID")
+		.argument("<name>", "Custom field name")
+		.action(async function (this: Command, item: string, name: string) {
+			const opts = getGlobalOpts(this);
+			emitData(await readItemField(name, item, opts, { customOnly: true }), opts);
 		});
-
-		if (!result) {
-			throw new CliError(
-				`No ${field} found for item: ${item}`,
-				ExitCode.NotFound,
-			);
-		}
-
-		if (field === "item") {
-			emitData(JSON.parse(result), opts);
-		} else {
-			emitData(result, opts);
-		}
-	} catch (err) {
-		if (
-			err instanceof CliError &&
-			/more than one result/i.test(err.message)
-		) {
-			const matches = await resolveAmbiguous(item);
-			throw new CliError(
-				formatAmbiguousError(item, matches, opts),
-				ExitCode.BadArgs,
-			);
-		}
-		throw err;
-	}
-}
-
-async function getCustomField(
-	fieldName: string,
-	item: string,
-	opts: ReturnType<typeof getGlobalOpts>,
-): Promise<void> {
-	const json = await withSession(opts, () =>
-		runBwOrThrow(["get", "item", item]),
-	);
-
-	const parsed = BwItemSchema.parse(JSON.parse(json));
-	const fields = parsed.fields ?? [];
-	const match = fields.find((f) => f.name === fieldName);
-
-	if (!match) {
-		const available = fields.map((f) => f.name).join(", ");
-		const msg = available
-			? `Field "${fieldName}" not found. Available: ${available}`
-			: `Field "${fieldName}" not found (item has no custom fields)`;
-		throw new CliError(msg, ExitCode.NotFound);
-	}
-
-	emitData(match.value ?? "", opts);
-}
-
-interface MatchInfo {
-	id: string;
-	name: string;
-	type: string;
-	username?: string;
-}
-
-async function resolveAmbiguous(query: string): Promise<MatchInfo[]> {
-	try {
-		const json = await runBwOrThrow([
-			"list",
-			"items",
-			"--search",
-			query,
-		]);
-		const items: Array<Record<string, unknown>> = JSON.parse(json);
-		return items.map((i) => ({
-			id: i.id as string,
-			name: i.name as string,
-			type: BW_TYPE_LABELS[i.type as number] ?? `type:${i.type}`,
-			username: (i.login as Record<string, unknown> | null)?.username as
-				| string
-				| undefined,
-		}));
-	} catch {
-		return [];
-	}
-}
-
-function formatAmbiguousError(
-	query: string,
-	matches: MatchInfo[],
-	opts: { json?: boolean },
-): string {
-	if (matches.length === 0) {
-		return `Multiple items match "${query}". Use a specific ID instead.`;
-	}
-
-	if (opts.json) {
-		return `Multiple items match "${query}": ${JSON.stringify(matches)}`;
-	}
-
-	const lines = [`Multiple items match "${query}":\n`];
-	for (const m of matches) {
-		const user = m.username ? ` (${m.username})` : "";
-		lines.push(`  ${pc.dim(m.id)}  ${pc.cyan(m.type)}  ${m.name}${pc.dim(user)}`);
-	}
-	lines.push(`\nUse a specific ID: ${pc.dim("bwx get <field> <id>")}`);
-	return lines.join("\n");
 }

package/src/cli/commands/list.ts

@@ -1,11 +1,9 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
-import { emitData } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
+import { filterItems, writeItems, type ItemListOptions } from "../items.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
-import { BW_TYPE_LABELS, BW_TYPE_FROM_NAME } from "../../bw/types.ts";
-import pc from "picocolors";
 
 export function registerList(program: Command): void {
 	program
@@ -15,10 +13,11 @@ export function registerList(program: Command): void {
 		.argument("[type]", "Filter by type: logins|notes|cards|identities")
 		.option("--folder <id>", "Filter by folder ID")
 		.option("--limit <n>", "Limit results", parseInt)
+		.option("--full-items", "Emit complete item objects (includes secrets)")
 		.action(async function (
 			this: Command,
 			type: string | undefined,
-			localOpts: { folder?: string; limit?: number },
+			localOpts: ItemListOptions & { folder?: string },
 		) {
 			const opts = getGlobalOpts(this);
 
@@ -28,54 +27,12 @@ export function registerList(program: Command): void {
 			}
 
 			const json = await withSession(opts, () => runBwOrThrow(args));
-			let items: Array<Record<string, unknown>> = JSON.parse(json);
-
-			if (type) {
-				const typeVal = BW_TYPE_FROM_NAME[type];
-				if (typeVal === undefined) {
-					throw new CliError(
-						`Invalid type "${type}". Valid: logins, notes, cards, identities`,
-						ExitCode.BadArgs,
-					);
-				}
-				items = items.filter((i) => i.type === typeVal);
-			}
-
-			if (localOpts.limit && localOpts.limit > 0) {
-				items = items.slice(0, localOpts.limit);
-			}
+			const items = filterItems(JSON.parse(json), { ...localOpts, type });
 
 			if (items.length === 0) {
 				throw new CliError("No items found", ExitCode.NotFound);
 			}
 
-			if (opts.json) {
-				emitData(items, opts);
-				return;
-			}
-
-			if (opts.plain) {
-				for (const item of items) {
-					const t =
-						BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
-					const login = item.login as Record<string, unknown> | null;
-					const username = login?.username ?? "-";
-					process.stdout.write(
-						`${item.id}\t${t}\t${item.name}\t${username}\n`,
-					);
-				}
-				return;
-			}
-
-			for (const item of items) {
-				const t =
-					BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
-				const login = item.login as Record<string, unknown> | null;
-				const username = login?.username ?? "";
-				const userPart = username ? pc.dim(` (${username})`) : "";
-				process.stdout.write(
-					`${pc.dim(item.id as string)}  ${pc.cyan(t)}  ${item.name}${userPart}\n`,
-				);
-			}
+			writeItems(items, opts, localOpts);
 		});
 }

package/src/cli/commands/run.ts

@@ -0,0 +1,138 @@
+import type { Command } from "commander";
+import { constants } from "node:os";
+import { readItemField } from "../../bw/fields.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { collect } from "../input.ts";
+import { emitLog } from "../io.ts";
+import { getGlobalOpts } from "../program.ts";
+import type { GlobalOptions } from "../types.ts";
+
+/** `NAME=<field>:<item>` — one secret to place in the child's environment. */
+export interface EnvSpec {
+	name: string;
+	field: string;
+	item: string;
+}
+
+const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+const SPEC_HINT = "Expected --env NAME=<field>:<item>, e.g. --env DB_PASS=password:'Prod DB'";
+
+export function registerRun(program: Command): void {
+	program
+		.command("run")
+		.description("Run a command with secrets injected into its environment")
+		.argument("<command...>", "Command to run — use -- before it if it takes its own flags")
+		.option(
+			"--env <spec>",
+			"Inject a secret as NAME=<field>:<item> (repeatable)",
+			collect,
+			[],
+		)
+		.action(async function (
+			this: Command,
+			command: string[],
+			localOpts: { env: string[] },
+		) {
+			const opts = getGlobalOpts(this);
+			const specs = parseEnvSpecs(localOpts.env);
+
+			const secrets = await resolveSecrets(specs, opts);
+
+			// Only the names are ever logged; values exist solely in the child env.
+			if (opts.verbose) {
+				emitLog(`Injecting ${specs.map((s) => s.name).join(", ")}`, opts);
+			}
+
+			process.exit(await spawnChild(command, secrets));
+		});
+}
+
+/** Parses every `--env` flag, rejecting bad specs before any vault access. */
+export function parseEnvSpecs(raws: string[]): EnvSpec[] {
+	if (raws.length === 0) {
+		throw new CliError(`No secrets requested. ${SPEC_HINT}`, ExitCode.BadArgs);
+	}
+
+	const specs = raws.map(parseEnvSpec);
+
+	const seen = new Set<string>();
+	for (const spec of specs) {
+		if (seen.has(spec.name)) {
+			throw new CliError(`Duplicate --env name "${spec.name}"`, ExitCode.BadArgs);
+		}
+		seen.add(spec.name);
+	}
+
+	return specs;
+}
+
+/**
+ * Splits `NAME=<field>:<item>` on the first `=` and then the first `:`, so item
+ * names may contain colons (`password:http://my.router`) while field names may not.
+ * Fields resolve exactly as in `bwx get`: built-ins first, otherwise custom fields.
+ */
+export function parseEnvSpec(raw: string): EnvSpec {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) {
+		throw new CliError(`Invalid --env "${raw}". ${SPEC_HINT}`, ExitCode.BadArgs);
+	}
+
+	const name = raw.slice(0, eq);
+	if (!ENV_NAME_RE.test(name)) {
+		throw new CliError(
+			`Invalid environment variable name "${name}". Use letters, digits, and underscores.`,
+			ExitCode.BadArgs,
+		);
+	}
+
+	const ref = raw.slice(eq + 1);
+	const colon = ref.indexOf(":");
+	if (colon <= 0 || colon === ref.length - 1) {
+		throw new CliError(`Invalid --env "${raw}". ${SPEC_HINT}`, ExitCode.BadArgs);
+	}
+
+	return { name, field: ref.slice(0, colon), item: ref.slice(colon + 1) };
+}
+
+/** Resolves secrets one at a time: each read spawns `bw`, and unlocks must not race. */
+async function resolveSecrets(
+	specs: EnvSpec[],
+	opts: GlobalOptions,
+): Promise<Record<string, string>> {
+	const secrets: Record<string, string> = {};
+
+	for (const spec of specs) {
+		secrets[spec.name] = await readItemField(spec.field, spec.item, opts);
+	}
+
+	return secrets;
+}
+
+/**
+ * Runs the child with inherited stdio so it stays usable interactively, and
+ * mirrors its exit status (`128 + signal` when it was killed, as shells do).
+ */
+async function spawnChild(
+	command: string[],
+	secrets: Record<string, string>,
+): Promise<number> {
+	let proc;
+	try {
+		proc = Bun.spawn(command, {
+			stdin: "inherit",
+			stdout: "inherit",
+			stderr: "inherit",
+			env: { ...process.env, ...secrets },
+		});
+	} catch (err) {
+		throw new CliError(
+			`Failed to run "${command[0]}": ${err instanceof Error ? err.message : String(err)}`,
+			ExitCode.BadArgs,
+		);
+	}
+
+	const exitCode = await proc.exited;
+	const signal = proc.signalCode;
+	return signal ? 128 + constants.signals[signal] : exitCode;
+}

package/src/cli/commands/search.ts

@@ -1,11 +1,9 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
-import { emitData } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
+import { filterItems, writeItems, type ItemListOptions } from "../items.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
-import { BW_TYPE_LABELS, BW_TYPE_FROM_NAME } from "../../bw/types.ts";
-import pc from "picocolors";
 
 export function registerSearch(program: Command): void {
 	program
@@ -15,10 +13,11 @@ export function registerSearch(program: Command): void {
 		.option("--type <type>", "Filter by type: login|note|card|identity")
 		.option("--folder <id>", "Filter by folder ID")
 		.option("--limit <n>", "Limit results", parseInt)
+		.option("--full-items", "Emit complete item objects (includes secrets)")
 		.action(async function (
 			this: Command,
 			query: string,
-			localOpts: { type?: string; folder?: string; limit?: number },
+			localOpts: ItemListOptions & { folder?: string },
 		) {
 			const opts = getGlobalOpts(this);
 
@@ -28,24 +27,7 @@ export function registerSearch(program: Command): void {
 			}
 
 			const json = await withSession(opts, () => runBwOrThrow(args));
-			let items: Array<Record<string, unknown>> = JSON.parse(json);
-
-			// Filter by type
-			if (localOpts.type) {
-				const typeVal = BW_TYPE_FROM_NAME[localOpts.type];
-				if (typeVal === undefined) {
-					throw new CliError(
-						`Invalid type "${localOpts.type}". Valid: login, note, card, identity`,
-						ExitCode.BadArgs,
-					);
-				}
-				items = items.filter((i) => i.type === typeVal);
-			}
-
-			// Limit
-			if (localOpts.limit && localOpts.limit > 0) {
-				items = items.slice(0, localOpts.limit);
-			}
+			const items = filterItems(JSON.parse(json), localOpts);
 
 			if (items.length === 0) {
 				throw new CliError(
@@ -54,32 +36,6 @@ export function registerSearch(program: Command): void {
 				);
 			}
 
-			if (opts.json) {
-				emitData(items, opts);
-				return;
-			}
-
-			if (opts.plain) {
-				for (const item of items) {
-					const type = BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
-					const login = item.login as Record<string, unknown> | null;
-					const username = login?.username ?? "-";
-					process.stdout.write(
-						`${item.id}\t${type}\t${item.name}\t${username}\n`,
-					);
-				}
-				return;
-			}
-
-			// Human-friendly table
-			for (const item of items) {
-				const type = BW_TYPE_LABELS[item.type as number] ?? `type:${item.type}`;
-				const login = item.login as Record<string, unknown> | null;
-				const username = login?.username ?? "";
-				const userPart = username ? pc.dim(` (${username})`) : "";
-				process.stdout.write(
-					`${pc.dim(item.id as string)}  ${pc.cyan(type)}  ${item.name}${userPart}\n`,
-				);
-			}
+			writeItems(items, opts, localOpts);
 		});
 }

package/src/cli/commands/status.ts

@@ -1,8 +1,8 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitData } from "../io.ts";
-import { getStatus } from "../../bw/session.ts";
-import { BW_TYPE_LABELS } from "../../bw/types.ts";
+import { recordStatus } from "../../bw/freshness.ts";
+import { getStatus } from "../../bw/status.ts";
 import pc from "picocolors";
 
 export function registerStatus(program: Command): void {
@@ -12,6 +12,8 @@ export function registerStatus(program: Command): void {
 		.action(async function (this: Command) {
 			const opts = getGlobalOpts(this);
 			const status = await getStatus();
+			// Reads reuse this for their staleness check instead of paying for `bw status`.
+			recordStatus(status);
 
 			if (opts.json || opts.plain) {
 				emitData(status, opts);

package/src/cli/commands/sync.ts

@@ -1,6 +1,7 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitSuccess } from "../io.ts";
+import { recordSyncNow } from "../../bw/freshness.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 
@@ -10,7 +11,11 @@ export function registerSync(program: Command): void {
 		.description("Sync vault (auto-unlocks)")
 		.action(async function (this: Command) {
 			const opts = getGlobalOpts(this);
-			await withSession(opts, () => runBwOrThrow(["sync"]));
+			// This *is* the freshness fix — checking freshness first would be circular.
+			await withSession(opts, () => runBwOrThrow(["sync"]), {
+				skipFreshnessCheck: true,
+			});
+			recordSyncNow();
 			emitSuccess("Vault synced", opts);
 		});
 }

package/src/cli/duration.ts

@@ -0,0 +1,34 @@
+import { CliError, ExitCode } from "./errors.ts";
+
+const UNIT_MS: Record<string, number> = {
+	ms: 1,
+	s: 1_000,
+	m: 60_000,
+	h: 3_600_000,
+	d: 86_400_000,
+};
+
+const DURATION_RE = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)?$/;
+
+/** Parses `250ms`, `30s`, `15m`, `2h`, `1d`. A bare number is seconds. */
+export function parseDuration(raw: string, flag: string): number {
+	const match = DURATION_RE.exec(raw.trim());
+	if (!match) {
+		throw new CliError(
+			`Invalid duration "${raw}" for ${flag}. Use e.g. 30s, 15m, 2h`,
+			ExitCode.BadArgs,
+		);
+	}
+	return Math.round(Number(match[1]) * UNIT_MS[match[2] ?? "s"]!);
+}
+
+/** Coarse human-readable duration for diagnostics: `45s`, `12m`, `3h`, `8d`. */
+export function formatDuration(ms: number): string {
+	const seconds = Math.max(0, Math.round(ms / 1000));
+	if (seconds < 60) return `${seconds}s`;
+	const minutes = Math.round(seconds / 60);
+	if (minutes < 60) return `${minutes}m`;
+	const hours = Math.round(minutes / 60);
+	if (hours < 48) return `${hours}h`;
+	return `${Math.round(hours / 24)}d`;
+}