bwx 0.4.1 → 0.6.0

package/src/cli/input.ts

@@ -1,4 +1,5 @@
 import { parseFieldFlag, type ParsedField } from "../bw/encoding.ts";
+import { normalizeTotpInput } from "../bw/totp.ts";
 import { CliError, ExitCode } from "./errors.ts";
 
 export function collect(val: string, prev: string[]): string[] {
@@ -6,6 +7,17 @@ export function collect(val: string, prev: string[]): string[] {
 	return prev;
 }
 
+/** Reads a single line from stdin, for the few interactive prompts bwx has. */
+export async function readLine(): Promise<string> {
+	const chunks: Uint8Array[] = [];
+	for await (const chunk of Bun.stdin.stream()) {
+		chunks.push(chunk);
+		const text = Buffer.concat(chunks).toString();
+		if (text.includes("\n")) return text.split("\n")[0]!.trim();
+	}
+	return Buffer.concat(chunks).toString().trim();
+}
+
 /**
  * Lazily reads stdin once. Commands validate that only one explicit stdin source
  * is selected, but caching also keeps implicit legacy stdin reads predictable.
@@ -25,6 +37,8 @@ export interface TextSource {
 	stdin?: boolean;
 	file?: string;
 	env?: string;
+	/** Produces the value instead of reading it — see `--password-generate`. */
+	generate?: () => Promise<string>;
 	flagNames: string[];
 	allowEmpty?: boolean;
 }
@@ -45,11 +59,20 @@ export interface ItemTextInputs {
 	passwordStdin?: boolean;
 	passwordFile?: string;
 	passwordEnv?: string;
+	passwordGenerate?: boolean;
+	totp?: string;
+	totpStdin?: boolean;
+	totpFile?: string;
+	totpEnv?: string;
 }
 
 export interface ResolvedItemTextInputs {
 	notes?: string;
 	password?: string;
+	/** True when the password was generated, so callers can keep it unprinted. */
+	passwordGenerated?: boolean;
+	/** Normalized and validated by {@link normalizeTotpInput} before it is stored. */
+	totp?: string;
 }
 
 export interface ExplicitStdinInputs extends ItemTextInputs {
@@ -63,15 +86,18 @@ const PASSWORD_SOURCE_FLAGS = [
 	"--password-stdin",
 	"--password-file",
 	"--password-env",
+	"--password-generate",
 ];
+const TOTP_SOURCE_FLAGS = ["--totp", "--totp-stdin", "--totp-file", "--totp-env"];
 
 export async function resolveItemTextInputs(
 	inputs: ItemTextInputs,
 	stdin: StdinReader,
+	generatePassword?: () => Promise<string>,
 ): Promise<ResolvedItemTextInputs> {
 	assertSingleStdinSource(listExplicitStdinInputs(inputs));
 
-	const [notes, password] = await Promise.all([
+	const [notes, password, totp] = await Promise.all([
 		resolveOptionalTextSource(
 			{
 				label: "notes",
@@ -89,13 +115,35 @@ export async function resolveItemTextInputs(
 				stdin: inputs.passwordStdin,
 				file: inputs.passwordFile,
 				env: inputs.passwordEnv,
+				generate:
+					inputs.passwordGenerate && generatePassword
+						? generatePassword
+						: undefined,
 				flagNames: PASSWORD_SOURCE_FLAGS,
 			},
 			stdin,
 		),
+		resolveOptionalTextSource(
+			{
+				label: "TOTP secret",
+				inline: inputs.totp,
+				stdin: inputs.totpStdin,
+				file: inputs.totpFile,
+				env: inputs.totpEnv,
+				flagNames: TOTP_SOURCE_FLAGS,
+			},
+			stdin,
+		),
 	]);
 
-	return { notes, password };
+	return {
+		notes,
+		password,
+		passwordGenerated: inputs.passwordGenerate ?? false,
+		// Validated here rather than at the call sites so every write path gets
+		// the check: a malformed seed is only ever noticed at the login it breaks.
+		totp: totp === undefined ? undefined : normalizeTotpInput(totp),
+	};
 }
 
 export function listExplicitStdinInputs(inputs: ExplicitStdinInputs): string[] {
@@ -103,6 +151,8 @@ export function listExplicitStdinInputs(inputs: ExplicitStdinInputs): string[] {
 		inputs.notesFile === "-" ? "--notes-file -" : null,
 		inputs.passwordStdin ? "--password-stdin" : null,
 		inputs.passwordFile === "-" ? "--password-file -" : null,
+		inputs.totpStdin ? "--totp-stdin" : null,
+		inputs.totpFile === "-" ? "--totp-file -" : null,
 		...(inputs.fieldFileFlag && inputs.fieldFiles
 			? stdinSourcesForFieldFiles(inputs.fieldFileFlag, inputs.fieldFiles)
 			: []),
@@ -118,6 +168,7 @@ export async function resolveOptionalTextSource(
 		source.stdin ? "stdin" : null,
 		source.file !== undefined ? "file" : null,
 		source.env !== undefined ? "env" : null,
+		source.generate !== undefined ? "generate" : null,
 	].filter((value): value is string => value !== null);
 
 	if (selected.length > 1) {
@@ -136,6 +187,8 @@ export async function resolveOptionalTextSource(
 		value = await stdin.read();
 	} else if (source.file !== undefined) {
 		value = await readFileOrStdin(source.file, stdin, source.label);
+	} else if (source.generate !== undefined) {
+		value = await source.generate();
 	} else {
 		value = readEnvValue(source.env!, source.label);
 	}

package/src/cli/io.ts

@@ -2,9 +2,19 @@ import pc from "picocolors";
 import { CliError, ExitCode } from "./errors.ts";
 import type { GlobalOptions } from "./types.ts";
 
-export function emitData(value: unknown, opts: GlobalOptions): void {
+/**
+ * `meta` rides along in the JSON envelope for facts about the response itself
+ * (truncation, counts) that a machine caller cannot recover from `data` alone.
+ * It is omitted entirely when absent, so `{ data }` stays the stable shape.
+ */
+export function emitData(
+	value: unknown,
+	opts: GlobalOptions,
+	meta?: Record<string, unknown>,
+): void {
 	if (opts.json) {
-		process.stdout.write(JSON.stringify({ data: value }, null, 2) + "\n");
+		const payload = meta ? { data: value, meta } : { data: value };
+		process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
 	} else if (opts.plain) {
 		if (typeof value === "string") {
 			process.stdout.write(value + "\n");

package/src/cli/items.ts

@@ -2,9 +2,17 @@ import pc from "picocolors";
 import { summarizeItem, type ItemSummary } from "../bw/items.ts";
 import { BW_TYPE_FROM_NAME } from "../bw/types.ts";
 import { CliError, ExitCode } from "./errors.ts";
-import { emitData } from "./io.ts";
+import { emitData, emitWarn } from "./io.ts";
 import type { GlobalOptions } from "./types.ts";
 
+/**
+ * Listings are capped by default: an uncapped `bwx list` returns the whole vault,
+ * which floods an agent's context and, with `--full-items`, dumps every secret in
+ * one call. `--limit 0` is the explicit opt-out, and truncation is always
+ * reported so a capped listing can never be mistaken for a complete one.
+ */
+export const DEFAULT_LIMIT = 50;
+
 export interface ItemListOptions {
 	type?: string;
 	limit?: number;
@@ -12,10 +20,29 @@ export interface ItemListOptions {
 	fullItems?: boolean;
 }
 
+export interface FilteredItems {
+	items: Array<Record<string, unknown>>;
+	/** Items matching the filters, before the limit was applied. */
+	total: number;
+}
+
+/** Commander option parser: rejects garbage instead of silently ignoring it. */
+export function parseLimit(raw: string): number {
+	// `Number("")` and `Number(" ")` are 0, which would read as "no limit".
+	const value = raw.trim() === "" ? Number.NaN : Number(raw);
+	if (!Number.isInteger(value) || value < 0) {
+		throw new CliError(
+			`Invalid --limit "${raw}". Use a non-negative integer (0 for no limit).`,
+			ExitCode.BadArgs,
+		);
+	}
+	return value;
+}
+
 export function filterItems(
 	items: Array<Record<string, unknown>>,
 	options: ItemListOptions,
-): Array<Record<string, unknown>> {
+): FilteredItems {
 	let result = items;
 
 	if (options.type) {
@@ -29,11 +56,10 @@ export function filterItems(
 		result = result.filter((item) => item.type === typeVal);
 	}
 
-	if (options.limit && options.limit > 0) {
-		result = result.slice(0, options.limit);
-	}
+	const total = result.length;
+	const limit = options.limit ?? DEFAULT_LIMIT;
 
-	return result;
+	return { items: limit > 0 ? result.slice(0, limit) : result, total };
 }
 
 /**
@@ -41,14 +67,32 @@ export function filterItems(
  * the same reduced projection, so asking for machine-readable output is a
  * serialization choice and never widens data access. `--full-items` is the
  * explicit opt-in for callers that genuinely need the complete objects.
+ *
+ * A truncated listing reports what it dropped through every channel — a stderr
+ * warning that survives `--json`, plus `meta` in the JSON envelope — because a
+ * silently capped list reads exactly like a complete one.
  */
 export function writeItems(
-	items: Array<Record<string, unknown>>,
+	filtered: FilteredItems,
 	opts: GlobalOptions,
 	options: ItemListOptions = {},
 ): void {
+	const { items, total } = filtered;
+	const omitted = total - items.length;
+
+	if (omitted > 0) {
+		emitWarn(
+			`Showing ${items.length} of ${total} items — pass --limit 0 for all.`,
+			opts,
+		);
+	}
+
 	if (opts.json) {
-		emitData(options.fullItems ? items : items.map(summarizeItem), opts);
+		emitData(
+			options.fullItems ? items : items.map(summarizeItem),
+			opts,
+			{ total, shown: items.length, truncated: omitted > 0 },
+		);
 		return;
 	}
 
@@ -63,12 +107,14 @@ export function writeItems(
 }
 
 function plainLine(summary: ItemSummary): string {
-	return `${summary.id}\t${summary.type}\t${summary.name}\t${summary.username ?? "-"}`;
+	const totp = summary.hasTotp ? "totp" : "-";
+	return `${summary.id}\t${summary.type}\t${summary.name}\t${summary.username ?? "-"}\t${totp}`;
 }
 
 function humanLine(summary: ItemSummary): string {
 	const userPart = summary.username ? pc.dim(` (${summary.username})`) : "";
-	return `${pc.dim(summary.id)}  ${pc.cyan(summary.type)}  ${summary.name}${userPart}`;
+	const totpPart = summary.hasTotp ? " " + pc.yellow("2fa") : "";
+	return `${pc.dim(summary.id)}  ${pc.cyan(summary.type)}  ${summary.name}${userPart}${totpPart}`;
 }
 
 function writeLines<T>(values: T[], format: (value: T) => string): void {

package/src/cli/program.ts

@@ -17,6 +17,9 @@ import { registerDoctor } from "./commands/doctor.ts";
 import { registerList } from "./commands/list.ts";
 import { registerAttach } from "./commands/attach.ts";
 import { registerRun } from "./commands/run.ts";
+import { registerGenerate } from "./commands/generate.ts";
+import { registerFolders } from "./commands/folders.ts";
+import { registerTrash } from "./commands/trash.ts";
 
 export function buildProgram(): Command {
 	const program = new Command();
@@ -59,8 +62,11 @@ export function buildProgram(): Command {
 	registerCreate(program);
 	registerEdit(program);
 	registerDelete(program);
+	registerTrash(program);
 	registerAttach(program);
 	registerList(program);
+	registerFolders(program);
+	registerGenerate(program);
 	registerConfig(program);
 	registerDoctor(program);