scripts: replace sudo credential wrapper with a Bitwarden launcher

brw/bw lookup in user space; optional token via custom field

1 files changed, 19 insertions, 11 deletions

diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 5281fb6..bd08da2 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -121,25 +121,33 @@ The TUI remembers the server and user (never the password) in
 a successful login. Precedence: `--socket`/`--user`, then `BOKFD_SOCKET`/
 `BOKFD_USER`, then that file.
 
-For a credential read from a root-only file, unlocked with `sudo`, create an
-admin-scoped token on the host and store it on the client machine:
+For credentials from a Bitwarden/Vaultwarden item, use the user-space
+launcher — nothing runs as root:
+
+```sh
+install -m 755 scripts/bokftui-bw ~/.local/bin/bokftui-bw
+BOKF_BW_ITEM=bokf bokftui-bw
+```
+
+`bokftui-bw` works with `rbw` (its agent keeps the vault unlocked for the
+session) or the official Bitwarden CLI `bw`, where the session key is cached
+in `~/.cache/bokf/bw-session` (mode 0600) so the master password is only
+asked when the session expires. It reads the item's password, or the custom
+field named by `BOKF_BW_FIELD`, and execs the TUI.
+
+Prefer a scoped, revocable API token over the account password: create one
+on the host, put it in a custom field (e.g. `token`) of the item, then:
 
 ```sh
 docker compose exec -e BOKFD_PASSWORD='<pw>' bokfd \
     bokfctl --user admin --org 1 token.create \
     '{"label":"tui-laptop","scopes":["read","write","admin"]}'
 
-# on the client machine:
-sudo install -d -m 700 /etc/bokf
-sudo sh -c 'umask 077; printf "%s\n" "bokf_..." > /etc/bokf/tui-token'
-install -m 755 scripts/bokftui-sudo ~/bin/bokftui-sudo
-bokftui-sudo
+BOKF_BW_KIND=token BOKF_BW_FIELD=token BOKF_BW_ITEM=bokf bokftui-bw
 ```
 
-`bokftui-sudo` runs `sudo -v`, reads `/etc/bokf/tui-token` (falling back to
-`/etc/bokf/tui-password`), exports the credential and execs `bokftui` as
-your user; with `BOKFD_TOKEN` set the TUI logs in without showing the login
-screen. Revoke the token with `token.revoke` when a machine goes away.
+With `BOKFD_TOKEN` set the TUI logs in without showing the login screen.
+Revoke the token with `token.revoke` when a machine goes away.
 
 ## TLS and external users