diff options
| -rw-r--r-- | docs/DEPLOY.md | 3 | ||||
| -rwxr-xr-x | scripts/bokftui-bw | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index bd08da2..8862fab 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -132,7 +132,8 @@ BOKF_BW_ITEM=bokf bokftui-bw `bokftui-bw` works with `rbw` (its agent keeps the vault unlocked for the session) or the official Bitwarden CLI `bw`, where the session key is cached in `~/.cache/bokf/bw-session` (mode 0600) so the master password is only -asked when the session expires. It reads the item's password, or the custom +asked when the session expires. On Node < 19 the launcher adds +`--experimental-global-webcrypto` when the SDK's WASM crypto needs it. It reads the item's password, or the custom field named by `BOKF_BW_FIELD`, and execs the TUI. Prefer a scoped, revocable API token over the account password: create one diff --git a/scripts/bokftui-bw b/scripts/bokftui-bw index 284828f..a067581 100755 --- a/scripts/bokftui-bw +++ b/scripts/bokftui-bw @@ -27,6 +27,12 @@ if command -v rbw >/dev/null 2>&1; then secret=$(rbw get "$item") fi elif command -v bw >/dev/null 2>&1; then + # The SDK's WASM crypto needs the Web Crypto global; Node < 19 only has + # it with this flag. Probe with a local command instead of guessing. + if ! bw generate -uln --length 1 >/dev/null 2>&1; then + NODE_OPTIONS="${NODE_OPTIONS:-} --experimental-global-webcrypto" + export NODE_OPTIONS + fi umask 077 cache="${XDG_CACHE_HOME:-$HOME/.cache}/bokf/bw-session" if [ -f "$cache" ]; then |