feat: Add rbw inject and rbw run commands

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ## Added
 
+* Added `rbw inject` and `rbw run` for rendering templates and launching
+  commands with `bw://` secret references (#246).
 * Added support for `rbw get --field=private_key` for ssh key entries (#291).
 * Added support for `rbw list --field=type` (Antoine Carnec, #283).
 * `rbw list --raw` and `rbw search --raw` now also include entry uris (#279).

Cargo.toml

@@ -87,6 +87,7 @@ zeroize = "1.8.2"
 arboard = { version = "3.6.1", default-features = false, features = [
     "wayland-data-control",
 ], optional = true }
+dotenvy = "0.15.7"
 
 [features]
 default = ["clipboard"]

README.md

@@ -130,6 +130,38 @@ flag will show the output as JSON. In addition to matching against the name,
 you can pass a UUID as the name to search for the entry with that id, or a
 URL to search for an entry with a matching website entry.
 
+### Template and command injection
+
+`rbw inject` can render templates containing secret references. References use
+the format `bw://<uuid-or-name>?field=<field>`, where the item can be addressed
+by UUID or by an exact name consisting only of letters, digits, `-`, and `_`.
+For items whose names contain spaces or other punctuation, use the item UUID
+instead. If `field` is omitted, the entry password is used. References can be
+written directly in the template or wrapped in `{{ bw://... }}`.
+
+By default, `rbw inject` reads the template from stdin and writes the rendered
+output to stdout. Use `--in-file` and `--out-file` to work with files instead:
+
+```sh
+echo 'database_password={{ bw://db-prod?field=password }}' | rbw inject
+rbw inject --in-file config.tpl --out-file config.yaml
+```
+
+`rbw run` reads environment bindings from `./.env` by default (or another file
+with `--env-file`), parses them using dotenv syntax, resolves any `bw://`
+references in the resulting values, and then runs the requested command without
+going through a shell:
+
+```sh
+cat > .env <<'EOF'
+DATABASE_URL=postgres://app:bw://db-prod?field=password@db.example/app
+API_TOKEN=bw://deploy-token
+EOF
+
+rbw run -- env
+rbw run --env-file .env.local -- docker compose up -d
+```
+
 *Note to users of the official Bitwarden server (at bitwarden.com)*: The
 official server has a tendency to detect command line traffic as bot traffic
 (see [this issue](https://github.com/bitwarden/cli/issues/383) for details). In