bwx 0.4.0 → 0.5.0

package/src/cli/commands/create.ts

@@ -5,6 +5,8 @@ import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 import { buildNewItem, bwEncode } from "../../bw/encoding.ts";
+import { generateSecret } from "../../bw/generate.ts";
+import { resolveFolderRef } from "../../bw/folders.ts";
 import {
 	assertSingleStdinSource,
 	collect,
@@ -15,6 +17,7 @@ import {
 	StdinReader,
 	type ItemTextInputs,
 } from "../input.ts";
+import { redactGeneratedPassword } from "./generate.ts";
 
 interface CreateOptions extends ItemTextInputs {
 	type: string;
@@ -27,8 +30,19 @@ interface CreateOptions extends ItemTextInputs {
 	folder?: string;
 	favorite?: boolean;
 	fromJson?: boolean;
+	generateLength?: number;
 }
 
+/** Flags a secure note has nowhere to store — see {@link assertLoginFlags}. */
+const LOGIN_ONLY_FLAGS: Array<[keyof CreateOptions, string]> = [
+	["username", "--username"],
+	["password", "--password"],
+	["passwordStdin", "--password-stdin"],
+	["passwordFile", "--password-file"],
+	["passwordEnv", "--password-env"],
+	["passwordGenerate", "--password-generate"],
+];
+
 export function registerCreate(program: Command): void {
 	program
 		.command("create").alias("add")
@@ -42,11 +56,13 @@ export function registerCreate(program: Command): void {
 		.option("--password-stdin", "Read password from stdin")
 		.option("--password-file <path>", "Read password from file (use - for stdin)")
 		.option("--password-env <name>", "Read password from environment variable")
+		.option("--password-generate", "Generate the password; it is never printed")
+		.option("--generate-length <n>", "Length for --password-generate", parseInt)
 		.option("--uri <url>", "URI (repeatable)", collect, [])
 		.option("--field <kv>", "Custom field k=v (repeatable)", collect, [])
 		.option("--field-file <kv>", "Custom field value from file k=path (repeatable)", collect, [])
 		.option("--field-env <kv>", "Custom field value from env var k=ENV (repeatable)", collect, [])
-		.option("--folder <id>", "Folder ID")
+		.option("--folder <name|id>", "Folder name or ID")
 		.option("--favorite", "Mark as favorite")
 		.option("--from-json", "Read full item JSON from stdin")
 		.action(async function (
@@ -57,6 +73,7 @@ export function registerCreate(program: Command): void {
 			const stdin = new StdinReader();
 
 			let encoded: string;
+			let generated = false;
 
 			if (localOpts.fromJson) {
 				const stdinText = await stdin.read();
@@ -82,6 +99,8 @@ export function registerCreate(program: Command): void {
 					);
 				}
 
+				assertLoginFlags(localOpts);
+
 				const explicitStdinSources = listExplicitStdinInputs({
 					...localOpts,
 					fieldFileFlag: "--field-file",
@@ -89,7 +108,10 @@ export function registerCreate(program: Command): void {
 				});
 				assertSingleStdinSource(explicitStdinSources);
 
-				const textInputs = await resolveItemTextInputs(localOpts, stdin);
+				const textInputs = await resolveItemTextInputs(localOpts, stdin, () =>
+					generateSecret({ length: localOpts.generateLength }),
+				);
+				generated = textInputs.passwordGenerated ?? false;
 				let notes = textInputs.notes;
 
 				// Backward compatibility: piped create input becomes note content.
@@ -119,7 +141,9 @@ export function registerCreate(program: Command): void {
 					password: textInputs.password ?? null,
 					uris: localOpts.uri,
 					fields,
-					folderId: localOpts.folder ?? null,
+					folderId: localOpts.folder
+						? await resolveFolderRef(localOpts.folder, opts)
+						: null,
 					favorite: localOpts.favorite ?? false,
 				});
 
@@ -132,11 +156,33 @@ export function registerCreate(program: Command): void {
 
 			const created = JSON.parse(result);
 			if (opts.json) {
-				emitData(created, opts);
+				emitData(redactGeneratedPassword(created, generated), opts);
 			} else if (opts.plain) {
 				emitData(created.id, opts);
 			} else {
-				emitSuccess(`Created "${created.name}" (${created.id})`, opts);
+				const note = generated ? " — password generated (not printed)" : "";
+				emitSuccess(`Created "${created.name}" (${created.id})${note}`, opts);
 			}
 		});
 }
+
+/**
+ * A secure note has no login object, so `buildNewItem` drops usernames,
+ * passwords, and URIs on the floor. Accepting them silently means a caller can
+ * "store" a credential, get exit 0, and end up with an item that never held it.
+ */
+function assertLoginFlags(localOpts: CreateOptions): void {
+	if (localOpts.type === "login") return;
+
+	const used = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
+		([, flag]) => flag,
+	);
+	if (localOpts.uri.length > 0) used.push("--uri");
+
+	if (used.length > 0) {
+		throw new CliError(
+			`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} --type login (a note cannot store them).`,
+			ExitCode.BadArgs,
+		);
+	}
+}

package/src/cli/commands/delete.ts

@@ -4,6 +4,8 @@ import { emitData, emitSuccess } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
+import { readLine } from "../input.ts";
+import type { GlobalOptions } from "../types.ts";
 import pc from "picocolors";
 
 export function registerDelete(program: Command): void {
@@ -12,7 +14,7 @@ export function registerDelete(program: Command): void {
 		.description("Delete a vault item")
 		.argument("<item>", "Item name or ID")
 		.option("--permanent", "Permanently delete (no trash)")
-		.option("--force", "Skip confirmation prompt")
+		.option("--force", "Skip confirmation prompt (required when not interactive)")
 		.action(async function (
 			this: Command,
 			item: string,
@@ -28,17 +30,7 @@ export function registerDelete(program: Command): void {
 			const itemId: string = current.id;
 			const itemName: string = current.name;
 
-			// Confirm unless --force, --json, or --plain
-			if (!localOpts.force && !opts.json && !opts.plain && process.stdin.isTTY) {
-				const label = localOpts.permanent ? "permanently delete" : "delete";
-				process.stderr.write(
-					`${pc.yellow("?")} ${label} "${itemName}" (${itemId})? [y/N] `,
-				);
-				const answer = await readLine();
-				if (answer.toLowerCase() !== "y") {
-					throw new CliError("Cancelled", ExitCode.UserCancelled);
-				}
-			}
+			await confirmDelete(itemName, itemId, localOpts, opts);
 
 			const args = ["delete", "item", itemId];
 			if (localOpts.permanent) args.push("--permanent");
@@ -46,22 +38,57 @@ export function registerDelete(program: Command): void {
 			await withSession(opts, () => runBwOrThrow(args));
 
 			if (opts.json) {
-				emitData({ id: itemId, name: itemName, deleted: true }, opts);
+				emitData(
+					{
+						id: itemId,
+						name: itemName,
+						deleted: true,
+						permanent: localOpts.permanent ?? false,
+					},
+					opts,
+				);
 			} else if (opts.plain) {
 				emitData(itemId, opts);
 			} else {
 				const label = localOpts.permanent ? "Permanently deleted" : "Deleted";
-				emitSuccess(`${label} "${itemName}" (${itemId})`, opts);
+				const undo = localOpts.permanent
+					? ""
+					: ` — undo with ${pc.dim(`bwx restore ${itemId}`)}`;
+				emitSuccess(`${label} "${itemName}" (${itemId})${undo}`, opts);
 			}
 		});
+
 }
 
-async function readLine(): Promise<string> {
-	const chunks: Uint8Array[] = [];
-	for await (const chunk of Bun.stdin.stream()) {
-		chunks.push(chunk);
-		const text = Buffer.concat(chunks).toString();
-		if (text.includes("\n")) return text.split("\n")[0]!.trim();
+/**
+ * A prompt only guards a human at a terminal. The common caller here is a script
+ * or an agent, where the prompt never renders — so anything non-interactive must
+ * say `--force` out loud instead of being deleted on the strength of a flag that
+ * silently did nothing.
+ */
+async function confirmDelete(
+	itemName: string,
+	itemId: string,
+	localOpts: { permanent?: boolean; force?: boolean },
+	opts: GlobalOptions,
+): Promise<void> {
+	if (localOpts.force) return;
+
+	const interactive = process.stdin.isTTY && !opts.json && !opts.plain;
+	const label = localOpts.permanent ? "permanently delete" : "delete";
+
+	if (!interactive) {
+		throw new CliError(
+			`Refusing to ${label} "${itemName}" (${itemId}) without confirmation. Pass --force.`,
+			ExitCode.BadArgs,
+		);
+	}
+
+	process.stderr.write(
+		`${pc.yellow("?")} ${label} "${itemName}" (${itemId})? [y/N] `,
+	);
+	const answer = await readLine();
+	if (answer.toLowerCase() !== "y") {
+		throw new CliError("Cancelled", ExitCode.UserCancelled);
 	}
-	return Buffer.concat(chunks).toString().trim();
 }

package/src/cli/commands/edit.ts

@@ -5,6 +5,9 @@ import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 import { patchItem, bwEncode } from "../../bw/encoding.ts";
+import { generateSecret } from "../../bw/generate.ts";
+import { resolveFolderRef } from "../../bw/folders.ts";
+import { BwItemType } from "../../bw/types.ts";
 import {
 	assertSingleStdinSource,
 	collect,
@@ -14,6 +17,7 @@ import {
 	StdinReader,
 	type ItemTextInputs,
 } from "../input.ts";
+import { redactGeneratedPassword } from "./generate.ts";
 
 interface EditOptions extends ItemTextInputs {
 	name?: string;
@@ -26,8 +30,18 @@ interface EditOptions extends ItemTextInputs {
 	folder?: string;
 	favorite?: boolean;
 	fromJson?: boolean;
+	generateLength?: number;
 }
 
+const LOGIN_ONLY_FLAGS: Array<[keyof EditOptions, string]> = [
+	["username", "--username"],
+	["password", "--password"],
+	["passwordStdin", "--password-stdin"],
+	["passwordFile", "--password-file"],
+	["passwordEnv", "--password-env"],
+	["passwordGenerate", "--password-generate"],
+];
+
 export function registerEdit(program: Command): void {
 	program
 		.command("edit")
@@ -41,12 +55,14 @@ export function registerEdit(program: Command): void {
 		.option("--password-stdin", "Read password from stdin")
 		.option("--password-file <path>", "Read password from file (use - for stdin)")
 		.option("--password-env <name>", "Read password from environment variable")
+		.option("--password-generate", "Generate the password; it is never printed")
+		.option("--generate-length <n>", "Length for --password-generate", parseInt)
 		.option("--uri <url>", "Set URIs (repeatable, replaces all)", collect, [])
 		.option("--add-field <kv>", "Add/update field k=v", collect, [])
 		.option("--add-field-file <kv>", "Add/update field value from file k=path", collect, [])
 		.option("--add-field-env <kv>", "Add/update field value from env var k=ENV", collect, [])
 		.option("--rm-field <name>", "Remove field by name", collect, [])
-		.option("--folder <id>", "Move to folder")
+		.option("--folder <name|id>", "Move to folder ('none' to unfile)")
 		.option("--favorite", "Set favorite")
 		.option("--no-favorite", "Unset favorite")
 		.option("--from-json", "Read full item JSON from stdin (replaces item)")
@@ -57,6 +73,7 @@ export function registerEdit(program: Command): void {
 		) {
 			const opts = getGlobalOpts(this);
 			const stdin = new StdinReader();
+			let generated = false;
 
 			const result = await withSession(opts, async () => {
 				// Fetch current item
@@ -73,6 +90,8 @@ export function registerEdit(program: Command): void {
 					}
 					encoded = bwEncode(stdinText);
 				} else {
+					assertLoginFlags(localOpts, current);
+
 					assertSingleStdinSource(
 						listExplicitStdinInputs({
 							...localOpts,
@@ -81,7 +100,10 @@ export function registerEdit(program: Command): void {
 						}),
 					);
 
-					const textInputs = await resolveItemTextInputs(localOpts, stdin);
+					const textInputs = await resolveItemTextInputs(localOpts, stdin, () =>
+						generateSecret({ length: localOpts.generateLength }),
+					);
+					generated = textInputs.passwordGenerated ?? false;
 
 					const addFields = await resolveFieldSources({
 						inline: localOpts.addField,
@@ -100,7 +122,9 @@ export function registerEdit(program: Command): void {
 						uris: localOpts.uri.length > 0 ? localOpts.uri : undefined,
 						addFields,
 						rmFields: localOpts.rmField,
-						folderId: localOpts.folder,
+						folderId: localOpts.folder
+							? await resolveFolderRef(localOpts.folder, opts)
+							: undefined,
 						favorite: localOpts.favorite,
 					});
 					encoded = bwEncode(JSON.stringify(patched));
@@ -111,11 +135,35 @@ export function registerEdit(program: Command): void {
 
 			const updated = JSON.parse(result);
 			if (opts.json) {
-				emitData(updated, opts);
+				emitData(redactGeneratedPassword(updated, generated), opts);
 			} else if (opts.plain) {
 				emitData(updated.id, opts);
 			} else {
-				emitSuccess(`Updated "${updated.name}" (${updated.id})`, opts);
+				const note = generated ? " — password generated (not printed)" : "";
+				emitSuccess(`Updated "${updated.name}" (${updated.id})${note}`, opts);
 			}
 		});
 }
+
+/**
+ * Same trap as `create`: only a login item has somewhere to put a password, so
+ * setting one on a note would be accepted and then quietly lost.
+ */
+function assertLoginFlags(
+	localOpts: EditOptions,
+	current: Record<string, unknown>,
+): void {
+	if (current.type === BwItemType.Login) return;
+
+	const used = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
+		([, flag]) => flag,
+	);
+	if (localOpts.uri.length > 0) used.push("--uri");
+
+	if (used.length === 0) return;
+
+	throw new CliError(
+		`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} a login item, but "${String(current.name)}" is not one.`,
+		ExitCode.BadArgs,
+	);
+}

package/src/cli/commands/folders.ts

@@ -0,0 +1,34 @@
+import type { Command } from "commander";
+import pc from "picocolors";
+import { listFolders } from "../../bw/folders.ts";
+import { emitData } from "../io.ts";
+import { getGlobalOpts } from "../program.ts";
+
+/**
+ * Folder IDs are the only handle `--folder` used to accept, and nothing else in
+ * bwx ever printed one — so this is what makes that flag usable at all.
+ */
+export function registerFolders(program: Command): void {
+	program
+		.command("folders")
+		.alias("folder")
+		.description("List vault folders")
+		.action(async function (this: Command) {
+			const opts = getGlobalOpts(this);
+			const folders = await listFolders(opts);
+
+			if (opts.json) {
+				emitData(folders, opts);
+				return;
+			}
+
+			for (const folder of folders) {
+				const id = folder.id ?? "-";
+				process.stdout.write(
+					opts.plain
+						? `${id}\t${folder.name}\n`
+						: `${pc.dim(id)}  ${folder.name}\n`,
+				);
+			}
+		});
+}

package/src/cli/commands/generate.ts

@@ -0,0 +1,57 @@
+import type { Command } from "commander";
+import { generateSecret, type GenerateOptions } from "../../bw/generate.ts";
+import { CliError, ExitCode } from "../errors.ts";
+import { emitData } from "../io.ts";
+import { getGlobalOpts } from "../program.ts";
+
+export function registerGenerate(program: Command): void {
+	program
+		.command("generate").alias("gen")
+		.description("Generate a password or passphrase (local, no vault access)")
+		.option("--length <n>", "Password length", parsePositiveInt("--length"))
+		.option("--no-uppercase", "Exclude uppercase letters")
+		.option("--no-lowercase", "Exclude lowercase letters")
+		.option("--no-numbers", "Exclude digits")
+		.option("-s, --special", "Include special characters")
+		.option("--ambiguous", "Allow ambiguous characters")
+		.option("--passphrase", "Generate a passphrase instead")
+		.option("--words <n>", "Words in the passphrase", parsePositiveInt("--words"))
+		.option("--separator <char>", "Passphrase word separator")
+		.option("--capitalize", "Capitalize passphrase words")
+		.option("--include-number", "Include a number in the passphrase")
+		.action(async function (this: Command, localOpts: GenerateOptions) {
+			const opts = getGlobalOpts(this);
+			emitData(await generateSecret(localOpts), opts);
+		});
+}
+
+/**
+ * Strips a password bwx generated out of the echoed item. The entire point of
+ * `--password-generate` is that the value goes to the vault without passing
+ * through the caller's terminal, transcript, or logs — echoing it back in the
+ * `--json` result would hand it straight back.
+ */
+export function redactGeneratedPassword(
+	item: Record<string, unknown>,
+	generated: boolean,
+): Record<string, unknown> {
+	if (!generated) return item;
+
+	const login = item.login as Record<string, unknown> | null | undefined;
+	if (!login) return item;
+
+	return { ...item, login: { ...login, password: "***GENERATED***" } };
+}
+
+function parsePositiveInt(flag: string): (raw: string) => number {
+	return (raw: string) => {
+		const value = Number(raw);
+		if (!Number.isInteger(value) || value <= 0) {
+			throw new CliError(
+				`Invalid ${flag} "${raw}". Use a positive integer.`,
+				ExitCode.BadArgs,
+			);
+		}
+		return value;
+	};
+}

package/src/cli/commands/get.ts

@@ -2,6 +2,7 @@ import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { emitData } from "../io.ts";
 import { readItemField } from "../../bw/fields.ts";
+import { CliError } from "../errors.ts";
 
 export function registerGet(program: Command): void {
 	program
@@ -18,11 +19,34 @@ export function registerGet(program: Command): void {
 
 	program
 		.command("field")
-		.description("Get a custom field from a vault item")
-		.argument("<item>", "Item name or ID")
+		.description("Get a custom field from a vault item (never a built-in)")
+		// Same order as `get`, which is the whole point of this command existing
+		// alongside it — the two used to take their arguments back to front.
 		.argument("<name>", "Custom field name")
-		.action(async function (this: Command, item: string, name: string) {
+		.argument("<item>", "Item name or ID")
+		.action(async function (this: Command, name: string, item: string) {
 			const opts = getGlobalOpts(this);
-			emitData(await readItemField(name, item, opts, { customOnly: true }), opts);
+			try {
+				emitData(
+					await readItemField(name, item, opts, { customOnly: true }),
+					opts,
+				);
+			} catch (err) {
+				throw withOrderHint(err);
+			}
 		});
 }
+
+/**
+ * `bwx field` took `<item> <name>` until 0.5.0. A caller using the old order
+ * fails somewhere unhelpful — a missing item, or a missing field on the wrong
+ * item — so say what changed rather than leaving them to guess.
+ */
+function withOrderHint(err: unknown): unknown {
+	if (!(err instanceof CliError)) return err;
+
+	return new CliError(
+		`${err.message}\n\nNote: 'bwx field' takes <name> <item> as of 0.5.0 (it was <item> <name>).`,
+		err.exitCode,
+	);
+}

package/src/cli/commands/list.ts

@@ -1,9 +1,15 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { CliError, ExitCode } from "../errors.ts";
-import { filterItems, writeItems, type ItemListOptions } from "../items.ts";
+import {
+	filterItems,
+	parseLimit,
+	writeItems,
+	type ItemListOptions,
+} from "../items.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
+import { resolveFolderFilter } from "../../bw/folders.ts";
 
 export function registerList(program: Command): void {
 	program
@@ -11,28 +17,39 @@ export function registerList(program: Command): void {
 		.alias("ls")
 		.description("List all vault items")
 		.argument("[type]", "Filter by type: logins|notes|cards|identities")
-		.option("--folder <id>", "Filter by folder ID")
-		.option("--limit <n>", "Limit results", parseInt)
+		.option("--type <type>", "Filter by type (same as the positional form)")
+		.option("--folder <name|id>", "Filter by folder name or ID ('none' for unfiled)")
+		.option("--limit <n>", "Limit results (0 for no limit)", parseLimit)
 		.option("--full-items", "Emit complete item objects (includes secrets)")
 		.action(async function (
 			this: Command,
-			type: string | undefined,
+			positionalType: string | undefined,
 			localOpts: ItemListOptions & { folder?: string },
 		) {
 			const opts = getGlobalOpts(this);
 
+			if (positionalType && localOpts.type && positionalType !== localOpts.type) {
+				throw new CliError(
+					`Conflicting types: "${positionalType}" and --type ${localOpts.type}`,
+					ExitCode.BadArgs,
+				);
+			}
+
 			const args = ["list", "items"];
 			if (localOpts.folder) {
-				args.push("--folderid", localOpts.folder);
+				args.push("--folderid", await resolveFolderFilter(localOpts.folder, opts));
 			}
 
 			const json = await withSession(opts, () => runBwOrThrow(args));
-			const items = filterItems(JSON.parse(json), { ...localOpts, type });
+			const filtered = filterItems(JSON.parse(json), {
+				...localOpts,
+				type: positionalType ?? localOpts.type,
+			});
 
-			if (items.length === 0) {
+			if (filtered.total === 0) {
 				throw new CliError("No items found", ExitCode.NotFound);
 			}
 
-			writeItems(items, opts, localOpts);
+			writeItems(filtered, opts, localOpts);
 		});
 }

package/src/cli/commands/run.ts

@@ -1,6 +1,6 @@
 import type { Command } from "commander";
 import { constants } from "node:os";
-import { readItemField } from "../../bw/fields.ts";
+import { readFields } from "../../bw/fields.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { collect } from "../input.ts";
 import { emitLog } from "../io.ts";
@@ -95,18 +95,23 @@ export function parseEnvSpec(raw: string): EnvSpec {
 	return { name, field: ref.slice(0, colon), item: ref.slice(colon + 1) };
 }
 
-/** Resolves secrets one at a time: each read spawns `bw`, and unlocks must not race. */
+/**
+ * Resolves every secret, paying one `bw` spawn per distinct *item* rather than
+ * per variable — pulling a username and password from the same item is a single
+ * vault read.
+ */
 async function resolveSecrets(
 	specs: EnvSpec[],
 	opts: GlobalOptions,
 ): Promise<Record<string, string>> {
-	const secrets: Record<string, string> = {};
-
-	for (const spec of specs) {
-		secrets[spec.name] = await readItemField(spec.field, spec.item, opts);
-	}
-
-	return secrets;
+	const values = await readFields(
+		specs.map((spec) => ({ field: spec.field, item: spec.item })),
+		opts,
+	);
+
+	return Object.fromEntries(
+		specs.map((spec, index) => [spec.name, values[index]!]),
+	);
 }
 
 /**

package/src/cli/commands/search.ts

@@ -1,18 +1,25 @@
 import type { Command } from "commander";
 import { getGlobalOpts } from "../program.ts";
 import { CliError, ExitCode } from "../errors.ts";
-import { filterItems, writeItems, type ItemListOptions } from "../items.ts";
+import {
+	filterItems,
+	parseLimit,
+	writeItems,
+	type ItemListOptions,
+} from "../items.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
+import { resolveFolderFilter } from "../../bw/folders.ts";
 
 export function registerSearch(program: Command): void {
 	program
-		.command("search").alias("find")
+		.command("search")
+		.alias("find")
 		.description("Search vault items")
 		.argument("<query>", "Search query")
 		.option("--type <type>", "Filter by type: login|note|card|identity")
-		.option("--folder <id>", "Filter by folder ID")
-		.option("--limit <n>", "Limit results", parseInt)
+		.option("--folder <name|id>", "Filter by folder name or ID ('none' for unfiled)")
+		.option("--limit <n>", "Limit results (0 for no limit)", parseLimit)
 		.option("--full-items", "Emit complete item objects (includes secrets)")
 		.action(async function (
 			this: Command,
@@ -23,19 +30,16 @@ export function registerSearch(program: Command): void {
 
 			const args = ["list", "items", "--search", query];
 			if (localOpts.folder) {
-				args.push("--folderid", localOpts.folder);
+				args.push("--folderid", await resolveFolderFilter(localOpts.folder, opts));
 			}
 
 			const json = await withSession(opts, () => runBwOrThrow(args));
-			const items = filterItems(JSON.parse(json), localOpts);
+			const filtered = filterItems(JSON.parse(json), localOpts);
 
-			if (items.length === 0) {
-				throw new CliError(
-					`No items matching "${query}"`,
-					ExitCode.NotFound,
-				);
+			if (filtered.total === 0) {
+				throw new CliError(`No items matching "${query}"`, ExitCode.NotFound);
 			}
 
-			writeItems(items, opts, localOpts);
+			writeItems(filtered, opts, localOpts);
 		});
 }