ayushnix / tessen

an interactive menu to autotype and copy pass and gopass data

tessen

tessen is a bash script that can autotype and copy data from password-store and gopass files. A wayland native dmenu is required to use tessen and the following dmenu backends are recognized

• fuzzel
• tofi
• bemenu
• yofi
• wofi
• rofi

As of version 2.2.0 of tessen, fuzzel is the default dmenu backend.

If you want to add another Wayland native dmenu not mentioned above, please see the CONTRIBUTING.md file for information about how to contribute to tessen.

tessen is written to work only on wayland wlroots compositors such as sway that support the virtual-keyboard-unstable-v1 protocol. If you'd rather use a fuzzy data selection program like fzf to copy your password-store data on both Xorg/X11 and Wayland, check out pass-tessen.

Why use tessen?

• tessen can autotype or copy (or do both at the same time!) your password store and gopass data including all of your key-value pair data

  From what I've observed, most scripts out there do not autotype and copy all of your key-value pair data. They also do not offer choices about autotyping or copying data with the same flexibility as tessen does.

  Although rofi-pass is a good alternative, it only works on Xorg/X11. tessen is made to work on Wayland.

• if you're using a web browser extension to access your passwords, you may wanna read an article by Tavis Ormandy on Password Managers

• tessen does not use any external programs unless absolutely necessary. This means that tessen doesn't need programs like sed, awk, tr, cut, find, sort, head, tail (although password-store needs them).

• the code is linted using shellcheck and formatted using shfmt. I've also tried to ensure that tessen doesn't leak any sensitive data. Please raise an issue or a pull request if you can make tessen more minimalistic or secure.

Installation

Dependencies

• bash

• at least one pass backend is needed - either password-store or gopass

• at least one Wayland native dmenu backend, preferably fuzzel, or tofi, bemenu, yofi, wofi, rofi

• at least one (or both if needed) action backend - wtype or wl-clipboard

• libnotify (optional, to send notifications about copied data and the timeout period after which the clipboard will be cleared)

• pass-otp (optional, to generate TOTP/HOTP when using pass)

• xdg-utils (optional, to open URLs in the default web browser)

• scdoc (optional, to build the man pages)

tessen is available in the following operating systems

Operating System
Arch Linux (AUR)
Alpine Linux
NixOS
GuixSD

Git Release

git clone https://git.sr.ht/~ayushnix/tessen
cd tessen
sudo make install

You can also do doas make install if you're using doas on Linux, which you probably should.

Stable Release

curl -LO https://git.sr.ht/~ayushnix/tessen/refs/download/v2.2.3/tessen-2.2.3.tar.gz
tar xvzf tessen-2.2.3.tar.gz
cd tessen-2.2.3/
sudo make install

or, you know, doas make install.

Optional Steps and Minimal Installation

There's an optional patch provided in the repository called explicit_path.patch which can be used to change the shebang from #!/usr/bin/env bash to #!/bin/bash. It also exports $PATH to

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

to prevent execution of arbitrary binaries not owned by the root user. If you want to apply this patch, execute

make expatch

before executing sudo make install. This patch should make tessen work fine on almost all Linux distributions except perhaps NixOS and GuixSD.

If you don't want to install the man pages or the shell completion files, you can use

sudo make minimal

to install the tessen and its default configuration file and nothing else. The man pages can be installed if needed using sudo make man, the bash completion file can be installed using sudo make bashcomp, and the fish completion file can be installed using sudo make fishcomp. For more information, use make help.

Features

• autotype or copy (or both at the same time!) data, including all valid key-value pairs, in pass and gopass
• generate TOTP/HOTP
• open URLs
• use custom values for user, password, url, autotype keys
• use custom autotype operations
• use custom delay time for autotype

Please read the man page for more information.

Caveats

The reason why tessen offers flexibility between autotyping and copying data is because autotyping may not always work accurately. There can be several reasons for this.

One of the reasons when autotype doesn't work is when a web page doesn't follow the standard expectation of having a username and password text field one after the other and links are inserted between them. A good example is the login popup offered by Discourse. In such cases, autotyping can make a real mess. This is why tessen also provides an option to define custom autotype operations.

tessen uses wtype for autotyping and it seems to work fine on Firefox. You'll need at least version v0.4, or later, of wtype for autotyping to work on Chromium although I've experienced issues on some websites when autotyping on Chromium using wtype. I haven't tested any other web browsers.

It also seems like autotyping on Wayland is in somewhat of a mess right now. An issue tracker on the the wayland-protocols repository by Roman Gilg titled Input Method Hub presents an overview on the state of things. As of version 1.7 of sway, the input-method-unstable-v2.xml protocol and the virtual-keyboard-unstable-v1.xml protocol (which is what wtype implements) are supported. There's ydotool but it requires root access to access /dev/uinput, which makes it unattractive.

What does tessen mean?

Here you go.

Why did you choose this weird name?

Because obvious names like pass-fzf and pass-clip are already taken by other projects? Also, for some reason, the way how bemenu and fuzzel's UI instantly opens up and displays relevant information reminded me of Japanese hand fans. I guess I was thinking of some anime while coming up with this name.

Contributions

Please see the CONTRIBUTING.md file.

Features that WILL NOT be implemented

• Xorg/X11 support

  either use rofi-pass or fork this repository and implement it yourself

• using ydotool, because it needs root access

• adding, editing, or removing existing password store data

• cache for storing frequently used password store selection data

• importing passwords or exporting them

tessen's Issues

Using `-a autotype` or `action=autotype` in config doesn't work as expected

Because the script explicitly assigns tsn_action="default" near the start, but later checks -z $tsn_action before changing the value, the value always remains "default", and both autotype and copy are always offered. Just commenting out the default assignment fixes the problem for me.

Thanks for the nice script.

Tessen creates an "invisible" folder

Hi,

I'm using Tessen with Wofi and noticed that it creates a folder named " " (white space) containing a dev subfolder containing itself a null subfolder.

The problem comes from the following line:

dmenu_backend_opts=('-d' '-k /dev/null')

It should be replaced with:

dmenu_backend_opts=('-d' '-k/dev/null')

or:

dmenu_backend_opts=('-d' '--cache-file=/dev/null')

Best regards

Feature request: support for smartcards/yubikey

I have gopass setup to use a gpg key that lives on my yubikey. This works fine with tessen as well, except for when I need to use a password to unlock it. Where gopass would normally prompt me with pinentry tessen doesn't generate any kind of prompt at all. This means I have to go enter the pin elsewhere to unlock the yubikey before I can use tessen. Ideally tessen would pop up with a pinentry window when it's necessary.

ignore spaces

thaks for writing tessen

I'm using tessen with wofi and when I'm searching for password I use multiple char separated by spaces to select the password I'm looking for

Unfortunatelly tessen is not ignoring spaces and is looking for it so I can't find my password unless I know the exact path location

is it possible for tessen to ignore spaces ?

Custom autotype

Right now autotype field is treated like a regular key value pair.

It would be nice to use it as an instruction for an autotype and hide it from selection.

Yofi backend support ?

Thanks for the app !

Is there any plan to support yofi as a backend ?

autotype clears clipboard

It seems like there is no real security benefit to clearing the clipboard on autotype?

allow using any dmenu backend

Maintaining a whitelist of allowed backends and their options doesn't sound good. tessen should let users choose a dmenu like backend of their own choosing. The list of available software I'm aware of that have a dmenu-like mode and work on Wayland are:

• rofi
• bemenu (probably the fastest)
• wofi (unmaintained and uses GTK, ugh)
• fuzzel

select password by default

Hi,
I'm looking for a way to select automatically the password once selected in tessen and skip the user/password selection as below

Is there a way to automatically select the password in tessen ?

allow configuring tessen using a configuration file

Using environment variables might be fine for very simple programs but, in my opinion, if a program has more than 4 or 5 options, it should use a configuration file. Restarting your login session or reloading your window manager just to change how a single program works is pretty stupid. Not to mention, your environment variables look like garbage that you'd never want in your ~/.bash_profile.

Sure, you could just script the whole thing or use `env BEMENU_OPTS='....' bemenu and then you won't need to restart your session/window manager but it's not really a good solution, in my opinion.

add support for passage

Filippo Valsorda has released a fork of pass called passage which uses age instead of gpg.

Notification mentions "username" no matter what the field you copy

https://github.com/ayushnix/tessen/blob/master/tessen#L457

According to the field you copy, this should be reflected on the notification text.

At first I though I was doing something wrong, and the username was always being copied.

---

Thanks for providing a Wayland alternative to rofi-pass, much appreciated.

No way to work with username key

If a username field is present in a gpg file, tessen would offer extra username is its selection.

However, filename would be used for both of them.

Support to ignore upper and lower case when searching

Since the search for entries is case sensitive, it is often difficult to find the appropriate entry. Is there perhaps already a configuration option that I have missed? Thank you very much.

Username override

Right now tessen assumes that username should be taken from a filename.
And that's it.
It's fine but should not be the only option.

It would be nice to use user or username key to override a filename.
Since it's explicitly specified, a user should be quite certain, that it should be used over a filename.

Add "totp" keyword for gopass compatibility

I was trying to figure out why OTP generation was not working correctly for me (I use gopass, and primarily totp tokens stored with the "totp" keyword).

Looking into the tessen script, I noticed the comment gopass totp is deprecated. May I ask why this is the case? It seems that a very minor change would make it work again, like this one.

Add support for gopass

gopass is a rewrite of the venerable pass code in golang. Unfortunately the commands are not always the same; the largest difference is gopass requires the use of a 'show' command to display output. Haven't tested the otp support, but with minimal changes tessen works really well with gopass.

config variable `pass_backend` no longer working in v2.2.0

I think in 002a364#diff-a9940e2f3ccc956ca93a818a6e399634544f70a82a3a5c7698c73333f74586d3R673 the pass_backend config key was renamed by accident:

-      if [[ $key == "pass_backend" ]] && [[ -z $pass_backend ]]; then
+     if [[ $key == "_PASS_BACKEND" ]] && [[ -z $_PASS_BACKEND ]]; then

_PASS_BACKEND works for now as a workaround though 😅

I opened #39, but I haven't yet reviewed 002a364 for other potential accidental renames.

add support for keepassxc

It looks like keepassxc provides a CLI interface and there are a few dmenu wrappers that use it although they also support adding, editing, and generating passwords. I'm not sure if I want to support those features.

Apparently, there's also something called the secret service API on Linux to retrieve passwords from an application that supports this and keepassxc seems to do that. If this is agnostic towards desktop environments and window managers, makes sense to support this as well.

using tessen in guix / rde

Hi, thanks for a nice program.

I am using this in gnu guix, which has a strong emphasis on repeatability and transparency -- as such, would you be open to allowing the specification of binary paths for the menus, as opposed to reading them from PATH?

A discussion about the nature of the use is open here https://lists.sr.ht/~abcdw/rde-devel/patches/29583

Cheers!
Samuel

Conflict with rofi and dmenu

Hello, previously i use rofi, then i installed tessen with

yay -S wtype
yay -S tessen

then tessen opened by dmenu?? how change tessen run with rofi . also my keybind are doubled with dmenu like if i press window tab / a usually it open rofi now its open tessen and rofi ( double )

Keybinding rofi

then when i close , it open rofi

filename used for username, not key

Hey there,
I really like this project overall, but there's one problem that's bugging me: I cannot get tessen to use login or username as the username value.
I added a regex pattern for the username value and it's still using the filename for the username.
My ~/.config/tessen/config:

dmenu_backend="fuzzel"
action="autotype"
delay="100"
notify="true"
userkey="(user.*|login)"

Any idea why that is happening?

gopass backend is not functional with gopass v1.15+

gopass v1.15 adopted a new configuration syntax and the output of gopass config has changed in such a way that tessen no longer parses it correctly. Previously the output was in this format:

autoclip: false
autoimport: true
cliptimeout: 45
exportkeys: true
keychain: false
nopager: false
notifications: true
parsing: true
path: /path/to/stores
safecontent: false

The new output is in this format:

age.usekeychain = false
core.autoclip = false
core.autoimport = true
core.autosync = true
core.cliptimeout = 45
core.exportkeys = true
core.nopager = false
core.notifications = true
core.parsing = true
core.showsafecontent = false
mounts.path = /path/to/stores

add support for ydotool

https://github.com/ReimuNotMoe/ydotool can be used as alternative for wtype for autotype feature. It can work not only for wayland apps.

add support for shortcut key bindings

requesting support for key bindings similar to the ones in rofi-pass:

# Custom Keybindings
autotype="Alt+1"
type_user="Alt+2"
type_pass="Alt+3"
open_url="Alt+4"
copy_name="Alt+u"
copy_url="Alt+l"
copy_pass="Alt+p"
show="Alt+o"
copy_entry="Alt+2"
type_entry="Alt+1"
copy_menu="Alt+c"
action_menu="Alt+a"
type_menu="Alt+t"
help="Alt+h"
switch="Alt+x"
insert_pass="Alt+n"

Password prompt

Hi,

I find your tessen as a great substitute of rofi-pass, given the technical context I am using - Arch linux, Wayland, Sway and wofi. Please consider that I am newbie in Arch and have some tolerance - the cool kids don't let me hang out with them oherwise.

What I am trying to do Is to bind tessen to a key bind, here is the code I have added in my ~/.config/sway/config:
bindsym Alt+p exec tessen

I used to pull that/similar trick in Ubuntu with rofi-pass and it worked great. I do not assume this is the correct way of doing.

The issue I have, is that when I run tessen with the key combination mentioned above, when it is the time to ask for a password to use the gpg key, which encrypts my secrets, no password prompt shows up. However, if I run tessen in the terminal (Alacrity with fish shell), I get password prompt, and after that I can use tessen through the shortcut combo while it is still authorized without any problems.

In short, how should I configure my system to get gui password prompt when I use tessen with a shortcut?

I know one of my colleagues is using rofi-pass in the same environment (Arch, Wayland and Sway), but he is on vacation and I want to make a good impression when he is back. :D I am not sure what trick he pulls to get the password prompt popup. Please help.

Sincerely

Passing backend options

Great project, thank you!
I've been trying to add an option to the rofi backend, for example, a font:

tessen -b 'rofi -dmenu -i -font "Roboto 11"'

but that doesn't seem to work. It'd be great to pass a font and a theme etc. Any ideas? Thanks!

add the default config file in `XDG_CONFIG_DIRS`

add support for bitwarden

The official bitwarden CLI isn't really human friendly but it does output JSON and that can be parsed with jq. An unofficial cli, rbw, seems like a much more human friendly interface.

It seems like there are already several dmenu wrapper projects for both the official CLI and for rbw. Still, it should be interesting to add support for bitwarden in tessen. We already support pass and gopass. I intend to add support for both the official CLI and rbw in the next major release of tessen.

Remove checking for oathtool?

Hi, I found this program to replace rofi-pass when using sway, and it works great!

However, I have some issues with otp. The reason is that I'm using NixOS, where all packaged are located in /nix/store/<some hashed path>, and oathtool is not in my PATH. Pass-otp is patched to use absolute path of oathtool, but tessen checks for oathtool and doesn't find it. So it displays an error after selecting otp.

I think checking for oathtool may not be necessary? Since the user already has pass-otp, you can assume that its dependencies are already taken care of.

Gopass multi store/mounts not working

When using gopass multistore/mounts it always says the password is empty
the command fails to know it's on a store

➜ tessen -d wofi -p gopass -a copy
misc/teste is empty

✖1 ✗  gopass show -n -f misc/teste
⚠ Entry "misc/teste" not found. Starting search...
✅ Found exact match in "pessoal/misc/teste"
Secret: pessoal/misc/teste

j6Ap)\u(w5
test: hello

➜ gopass mounts
gopass (/home/sfrique/.local/share/gopass/stores/root)
└── pessoal (/home/sfrique/.local/share/gopass/stores/pessoal)