scripts: bokftui-bw item selection (argument or picker)

2 files changed, 52 insertions, 11 deletions

diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 2964a19..7694add 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -145,13 +145,17 @@ launcher — nothing runs as root:
 install -m 755 scripts/bokftui-bw ~/.local/bin/bokftui-bw
 BOKF_BW_ITEM=bokf bokftui-bw
 ```
-
 `bokftui-bw` works with `rbw` (its agent keeps the vault unlocked for the
 session) or the official Bitwarden CLI `bw`, where the session key is cached
 in `~/.cache/bokf/bw-session` (mode 0600) so the master password is only
 asked when the session expires. On Node < 19 the launcher adds
-`--experimental-global-webcrypto` when the SDK's WASM crypto needs it. It reads the item's password, or the custom
-field named by `BOKF_BW_FIELD`, and execs the TUI.
+`--experimental-global-webcrypto` when the SDK's WASM crypto needs it. It
+reads the item's password, or the custom field named by `BOKF_BW_FIELD`, and
+execs the TUI.
+
+With several items matching `bokf`, pass one (`bokftui-bw bokf-anders`) or
+let it ask (`bokftui-bw` shows a numbered picker). `BOKF_BW_ITEM` does the
+same without an argument.
 
 Prefer a scoped, revocable API token over the account password: create one
 on the host, put it in a custom field (e.g. `token`) of the item, then:
diff --git a/scripts/bokftui-bw b/scripts/bokftui-bw
index a067581..1fdc4fe 100755
--- a/scripts/bokftui-bw
+++ b/scripts/bokftui-bw
@@ -2,7 +2,11 @@
 # Start bokftui with a credential fetched from a Bitwarden/Vaultwarden item.
 # Runs entirely as the invoking user — no root, no sudo.
 #
-#   BOKF_BW_ITEM   item name (default: bokf)
+#   bokftui-bw [item]
+#
+# The item is chosen from BOKF_BW_ITEM, the first argument, or — when several
+# items match "bokf" — an interactive picker. Per item:
+#
 #   BOKF_BW_FIELD  custom field that holds the secret (default: the password)
 #   BOKF_BW_KIND   password (default) exports BOKFD_PASSWORD;
 #                  token exports BOKFD_TOKEN
@@ -12,27 +16,56 @@
 # is only asked when the session expires or after a logout.
 set -eu
 
-item="${BOKF_BW_ITEM:-bokf}"
+item="${BOKF_BW_ITEM:-}"
+if [ -z "$item" ] && [ "$#" -gt 0 ]; then
+    item="$1"
+    shift
+fi
 field="${BOKF_BW_FIELD:-}"
 kind="${BOKF_BW_KIND:-password}"
 BOKFTUI="${BOKFTUI:-bokftui}"
 
+choose_item() {
+    # $1: newline-separated item names
+    names="$1"
+    n=$(printf '%s\n' "$names" | grep -c .)
+    if [ "$n" -eq 0 ]; then
+        echo "bokftui-bw: no matching item" >&2
+        exit 1
+    fi
+    if [ "$n" -eq 1 ]; then
+        printf '%s\n' "$names"
+        return
+    fi
+    if [ ! -t 0 ]; then
+        echo "bokftui-bw: several items match; pass one as an argument" >&2
+        printf '%s\n' "$names" >&2
+        exit 1
+    fi
+    echo "Välj konto:" >&2
+    i=1
+    printf '%s\n' "$names" | while IFS= read -r name; do
+        printf '  %d) %s\n' "$i" "$name" >&2
+        i=$((i + 1))
+    done
+    printf 'Nummer: ' >&2
+    read -r ans
+    printf '%s\n' "$names" | sed -n "${ans}p"
+}
+
 if command -v rbw >/dev/null 2>&1; then
     if ! rbw unlocked >/dev/null 2>&1; then
         rbw unlock
     fi
+    if [ -z "$item" ]; then
+        item=$(choose_item "$(rbw list 2>/dev/null | grep -i 'bokf' || true)")
+    fi
     if [ -n "$field" ]; then
         secret=$(rbw get --field "$field" "$item")
     else
         secret=$(rbw get "$item")
     fi
 elif command -v bw >/dev/null 2>&1; then
-    # The SDK's WASM crypto needs the Web Crypto global; Node < 19 only has
-    # it with this flag. Probe with a local command instead of guessing.
-    if ! bw generate -uln --length 1 >/dev/null 2>&1; then
-        NODE_OPTIONS="${NODE_OPTIONS:-} --experimental-global-webcrypto"
-        export NODE_OPTIONS
-    fi
     umask 077
     cache="${XDG_CACHE_HOME:-$HOME/.cache}/bokf/bw-session"
     if [ -f "$cache" ]; then
@@ -46,6 +79,10 @@ elif command -v bw >/dev/null 2>&1; then
         export BW_SESSION
         printf '%s\n' "$BW_SESSION" > "$cache"
     fi
+    if [ -z "$item" ]; then
+        item=$(choose_item "$(bw list items --search bokf 2>/dev/null |
+            jq -r '.[]? | .name' || true)")
+    fi
     if [ -n "$field" ]; then
         secret=$(bw get item "$item" | jq -r --arg f "$field" \
             '.fields[]? | select(.name == $f) | .value' | head -n 1)