opdotenv 1.0.3 → 1.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd66207d97fd6cf74fe9eaf05dcd22e43b05dd68af9995dcc5348be00fd465ae
-  data.tar.gz: 78f719f95dcd42edbdde3e00ed0be0ca9be5ef470055e0a6e49623f3599fd566
+  metadata.gz: 9bbc6ae3316e89e48c9c52e3f3aa33f3a3572217eab08b88ddc98283989b7f04
+  data.tar.gz: e964c986cd6676f4a0f3d0c3c33f633b520c9f277b6030f79a407f0db3cd8fdd
 SHA512:
-  metadata.gz: 4ba1fbc82986e6a20c8302c21bf27e0c61a3ba4703379dc0a9966d115d0101c8383497a7eea4a14cbce010eff8a94d273f98a6da1c5c01810773d2dc70c6400a
-  data.tar.gz: f695a8cf1a6e7e1f3c2daba02609366618b82f66162c45a4f64912e50dae71313dfab2cc0cd276dfae8409f43ba6895707a3a85b9447eaea4af00653bebd82e6
+  metadata.gz: e1c8b865089d2a6a2463f7ebc5edffd60566a826fb9667c792ef02c61c113a309a892adf2fbb5ade5115868fcc52b58919a15b79ecb3e84d3017531a6aebb678
+  data.tar.gz: 2e308264ed8c9aadbd846daef1c9804f98f8571cffd902be3fece3613b586d5240edffa4d0d2dffa2008573a3280e6994f5089635628a4bc1a4a6af1d70be2ff

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # CHANGELOG
 
+## 1.0.6 (2026-11-03)
+
+- Keep exported secrets out of 1Password CLI command arguments.
+- Upsert Secure Note exports on create and edit for both `op` CLI and Connect.
+- Use dedicated configuration items for CLI exports; existing-item updates cannot preserve passkeys.
+- Infer export formats correctly when no override is supplied; match `.env` basenames only.
+- Accept successful Connect API creation responses and avoid repeating writes after timeouts.
+- Filter Connect item lookups by title and omit server response values from error messages.
+- Fetch item details once per read after the filtered list.
+- Cancel release preparation when confirmation input is closed.
+
+## 1.0.5 (2026-07-06)
+
+- Improve `OPDOTENV_DEBUG` field summary logging in Anyway Config integration to build messages only when Rails debug logging is active
+- Skip field summary debug output when a 1Password item has no fields
+
+## 1.0.4 (2026-07-05)
+
+- Move `railties` from runtime to development dependency in gemspec
+- Non-Rails installs no longer pull in the Rails gem tree; Rails apps already provide `railties`
+
 ## 1.0.3 (2025-11-07)
 
 - Fix exit code handling in OpClient by using Open3.capture2e instead of IO.popen for reliable process status

data/README.md

@@ -1,15 +1,9 @@
 # opdotenv
 
-[![Gem Version](https://badge.fury.io/rb/opdotenv.svg?v=1.0.3)](https://badge.fury.io/rb/opdotenv) [![Test Status](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/opdotenv.rb/graph/badge.svg?token=U4FMVZGO8R)](https://codecov.io/gh/amkisko/opdotenv.rb)
+[![Gem Version](https://badge.fury.io/rb/opdotenv.svg?v=1.0.6)](https://badge.fury.io/rb/opdotenv) [![Test Status](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/opdotenv.rb/graph/badge.svg?token=U4FMVZGO8R)](https://app.codecov.io/github/amkisko/opdotenv.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_opdotenv.rb&metric=alert_status)](https://sonarcloud.io/project/overview?id=amkisko_opdotenv.rb)
 
 Load environment variables from 1Password using the `op` CLI or 1Password Connect Server API. Supports dotenv, JSON, and YAML formats.
 
-Sponsored by [Kisko Labs](https://www.kiskolabs.com).
-
-<a href="https://www.kiskolabs.com">
-  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
-</a>
-
 ## Installation
 
 Add to your Gemfile:
@@ -26,7 +20,7 @@ Choose one:
   - You can configure a custom path via `OP_CLI_PATH` or `OPDOTENV_CLI_PATH` environment variables, or via Rails config (see below)
 - **1Password Connect Server** - set `OP_CONNECT_URL` and `OP_CONNECT_TOKEN` environment variables
 
-Ruby 2.7+ supported.
+Ruby 3.4+ required.
 
 ## Rails
 
@@ -42,16 +36,7 @@ Rails.application.configure do
 end
 ```
 
-Format is automatically inferred from item name or field name:
-- `.env.*` → dotenv format
-- `*.json` → JSON format
-- `*.yaml` or `*.yml` → YAML format
-- Other items → load all fields without parsing
-
-You can also specify the field name with extension in the path:
-- `op://Vault/Item Name/config.json` → uses field `config.json` as JSON
-- `op://Vault/Item Name/production.json` → uses field `production.json` as JSON
-- `op://Vault/Item Name/.env.development` → uses field `.env.development` as dotenv
+Format is inferred from the item or field basename (see [Supported formats](#supported-formats)). Field names with extensions work in the path, for example `op://Vault/Item Name/config.json`.
 
 ### 1Password Connect
 
@@ -135,16 +120,15 @@ class DatabaseConfig < Anyway::Config
 end
 ```
 
-### Conditional Loading (Recommended for Security)
+### Conditional loading
 
-For better security, only load from 1Password in development/test environments:
+Load from 1Password only in local or development environments:
 
 ```ruby
 class TestConfig < Anyway::Config
   config_name :test
   attr_config :enabled, :sample
 
-  # Only load from 1Password in local/development environments
   if Rails.env.local?
     loader_options opdotenv: {
       path: "op://Employee/.env.test"
@@ -153,7 +137,7 @@ class TestConfig < Anyway::Config
 end
 ```
 
-This ensures that production environments won't attempt to load secrets from 1Password, aligning with the [production recommendations](#environment-recommendation).
+See [Environment recommendation](#environment-recommendation).
 
 ### Loading All Fields from an Item
 
@@ -204,6 +188,8 @@ Dotenv.load(".env", ".env.development")
 
 ## Export to 1Password
 
+Use dedicated configuration items for exports through the `op` CLI. Export values are sent through standard input to keep them out of process arguments. Updating an existing item uses a JSON template and does not support items containing passkeys: 1Password warns that template updates overwrite passkeys. Do not export into a login item that contains a passkey. See the [1Password item edit documentation](https://www.1password.dev/cli/reference/management-commands/item#edit-an-item-using-a-template).
+
 ### CLI
 
 ```bash
@@ -235,50 +221,33 @@ Opdotenv::Exporter.export(
 
 ## Supported formats
 
-Format is automatically inferred from item name or field name:
-- `.env.*` → dotenv format (`KEY=VALUE`)
-- `*.json` → JSON format (nested structures flattened with underscores)
-- `*.yaml` or `*.yml` → YAML format (nested structures flattened with underscores)
-- Other items → load all fields without parsing
-
-Field names can be specified with extensions in the path:
-- `op://Vault/Item Name/config.json` → loads field `config.json` as JSON
-- `op://Vault/Item Name/production.json` → loads field `production.json` as JSON
-- `op://Vault/Item Name/.env.development` → loads field `.env.development` as dotenv
+Format is inferred from the item or field basename:
+- `.env` or `.env.*`: dotenv (`KEY=VALUE`)
+- `*.json`: JSON (nested keys flattened with underscores)
+- `*.yaml` or `*.yml`: YAML (nested keys flattened with underscores)
+- Other items: load all fields without parsing
 
-For advanced usage, you can explicitly specify `field_name` and `field_type` in the API.
+Field names with extensions work in the path, for example `op://Vault/Item Name/config.json`. Callers can also pass `field_name` and `field_type` to the API.
 
 ## Security
 
-### Environment Recommendation
-
-**⚠️ This gem is recommended for development and test environments only.**
-
-For production environments, we recommend using dedicated secret management solutions that integrate with your infrastructure:
+### Environment recommendation
 
-- **Kubernetes**: Use [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) or [External Secrets Operator](https://external-secrets.io/) with providers like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault
-- **AWS**: Use [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
-- **Azure**: Use [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault)
-- **GCP**: Use [Google Secret Manager](https://cloud.google.com/secret-manager)
+Use this gem in development and test. For production, prefer the secret store that matches the host:
 
-Provision secrets through infrastructure-as-code tools:
-- **Helm** (Kubernetes): Use `helm secrets` or external secrets operator
-- **Terraform**: Use `aws_secretsmanager_secret`, `azurerm_key_vault_secret`, or `google_secret_manager_secret`
-- **Bicep** (Azure): Use `Microsoft.KeyVault/vaults` resources
+- **Kubernetes**: [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) or [External Secrets Operator](https://external-secrets.io/) with AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault
+- **AWS**: [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
+- **Azure**: [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault)
+- **GCP**: [Google Secret Manager](https://cloud.google.com/secret-manager)
 
-These solutions provide:
-- Better audit trails and access controls
-- Integration with IAM/RBAC systems
-- Automatic secret rotation
-- Compliance with security standards
-- No dependency on external CLI tools or API servers
+Provision through infrastructure tools such as Helm, Terraform, or Bicep when that matches the host.
 
-### Security Considerations
+### Security considerations
 
-- **CLI mode**: Secrets fetched via authenticated `op` CLI session.
-- **Connect API mode**: Secrets fetched via HTTPS. Ensure tokens are secure.
-- The library does not persist secrets in memory or on disk.
-- Always verify 1Password CLI or Connect server is up to date and authenticated.
+- **CLI mode**: Secrets fetched via an authenticated `op` CLI session.
+- **Connect API mode**: Secrets fetched via HTTPS. Keep tokens out of logs and process arguments.
+- The library does not persist secrets in memory beyond the load, or on disk.
+- Keep the 1Password CLI or Connect server current and authenticated.
 
 ### Code Locations for Security Review
 
@@ -289,7 +258,7 @@ For security-sensitive applications, developers should review where this gem rea
 - **`lib/opdotenv/op_client.rb`**:
   - `read(path)` - Executes `op read` command to fetch a single field value
   - `item_get(item, vault:)` - Executes `op item get` command to fetch all item data as JSON
-  - `capture(args)` - Executes shell commands via `IO.popen` (array arguments, no shell interpretation)
+  - `capture(args)` - Runs the CLI via `Open3.capture2e` (array arguments, optional stdin)
 
 #### Reading Secrets (ConnectApiClient - API mode)
 
@@ -297,7 +266,7 @@ For security-sensitive applications, developers should review where this gem rea
   - `read(path)` - Makes HTTP GET request to fetch field or notesPlain content
   - `item_get(item_title, vault:)` - Searches and fetches item data via API
   - `get_item(vault_name, item_title)` - Fetches full item details including all fields
-  - `item_by_title_in_vault(vault_id, item_title)` - Lists items and fetches by title
+  - `item_by_title_in_vault(vault_id, item_title)` - Filters items by title and fetches full details
   - `list_vaults()` - Lists all accessible vaults (uses `api_request(:get, "/v1/vaults")`)
   - `vault_name_to_id(vault_name)` - Resolves vault names to IDs (cached)
   - `api_request(method, path, body)` - All HTTP requests go through this method
@@ -330,14 +299,14 @@ For security-sensitive applications, developers should review where this gem rea
 - **`lib/opdotenv/parsers/json_parser.rb`** - Parses and flattens JSON structures
 - **`lib/opdotenv/parsers/yaml_parser.rb`** - Parses YAML (safe_load with aliases: false)
 
-#### Data Flow
+#### Data flow
 
-1. **Configuration** → Rails config or direct API calls
-2. **Path Parsing** → `SourceParser.parse()` extracts vault/item/field from path
-3. **Client Selection** → `ClientFactory.create()` chooses CLI or API client
-4. **Secret Fetching** → Client reads from 1Password (CLI command or HTTP request)
-5. **Parsing** → Format-specific parser converts to key-value pairs
-6. **Environment Merge** → Secrets merged into `ENV` or provided hash
+1. **Configuration**: Rails config or direct API calls
+2. **Path parsing**: `SourceParser.parse()` extracts vault/item/field from path
+3. **Client selection**: `ClientFactory.create()` chooses CLI or API client
+4. **Secret fetching**: Client reads from 1Password (CLI command or HTTP request)
+5. **Parsing**: Format-specific parser converts to key-value pairs
+6. **Environment merge**: Secrets merged into `ENV` or provided hash
 
 All secret data flows through these code paths. No secrets are persisted to disk or logged (except explicit error messages).
 
@@ -345,11 +314,50 @@ All secret data flows through these code paths. No secrets are persisted to disk
 
 ```bash
 bundle install
-bundle exec rspec
+bundle exec polyrun parallel-rspec --workers 5 --merge-failures
 bundle exec rbs validate
 bundle exec standardrb --fix
 ```
 
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/amkisko/opdotenv.rb.
+
+Contribution policy:
+- New features are not necessarily added to the gem
+- Pull request should have test coverage for affected parts
+- Pull request should have changelog entry
+
+Review policy:
+- It might take up to 2 calendar weeks to review and merge critical fixes
+- It might take up to 6 calendar months to review and merge pull request
+- It might take up to 1 calendar year to review an issue
+
+## Security
+
+If you discover a security vulnerability, please report it responsibly. See [SECURITY.md](SECURITY.md) for details.
+
+## Links
+
+- [GitHub](https://github.com/amkisko/opdotenv.rb)
+- [GitLab](https://gitlab.com/amkisko/opdotenv.rb)
+- [RubyGems](https://rubygems.org/gems/opdotenv)
+- [Versions Atom](https://rubygems.org/gems/opdotenv/versions.atom) (feed id `9869611634128`)
+- [libraries.io](https://libraries.io/rubygems/opdotenv)
+- [Deps.dev](https://deps.dev/rubygems/opdotenv)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_opdotenv.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/opdotenv.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/opdotenv.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/opdotenv.rb)
+
 ## License
 
-MIT
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>

data/bin/opdotenv

@@ -27,7 +27,7 @@ when "export"
   end.parse!(ARGV)
   abort("--path and --file required") unless path && file
   # Infer format from file extension if not provided
-  field_type ||= infer_format_from_file(file)
+  field_type ||= Opdotenv::FormatInferrer.infer_from_name(file) || :dotenv
   text = File.read(file)
   data = Opdotenv::Loader.parse_by_format(text, field_type)
   Opdotenv::Exporter.export(path: path, data: data, field_type: field_type)
@@ -35,11 +35,3 @@ else
   warn "Usage: opdotenv (read|export) ..."
   exit 1
 end
-
-def infer_format_from_file(file)
-  case File.extname(file)
-  when ".json" then :json
-  when ".yaml", ".yml" then :yaml
-  else :dotenv
-  end
-end

data/lib/opdotenv/anyway_loader.rb

@@ -79,26 +79,38 @@ module Opdotenv
       def log_available_fields(original_data, env_prefix, matched_data)
         return unless ENV["OPDOTENV_DEBUG"] == "true"
         return unless defined?(Rails) && Rails.logger
+        return if original_data.keys.empty?
 
         prefix_upper = env_prefix.upcase
         prefix_with_underscore = "#{prefix_upper}_"
-
         available_fields = original_data.keys.map(&:to_s)
         matched_fields = matched_data.keys.map(&:to_s)
+        unmatched = unmatched_fields(available_fields, prefix_upper, prefix_with_underscore)
+
+        log_field_summary(available_fields, matched_fields, env_prefix, prefix_with_underscore)
+        log_unmatched_fields(unmatched, prefix_with_underscore) if unmatched.any?
+      end
 
-        # Find fields that were available but didn't match the prefix (case-insensitive)
-        unmatched = available_fields.reject do |field|
+      def unmatched_fields(available_fields, prefix_upper, prefix_with_underscore)
+        available_fields.reject do |field|
           field_upper = field.to_s.upcase
           field_upper.start_with?(prefix_with_underscore) || field_upper == prefix_upper
         end
+      end
 
-        if available_fields.any?
-          Rails.logger.debug("[opdotenv] Available fields from 1Password: #{available_fields.join(", ")}")
-          Rails.logger.debug("[opdotenv] Matched fields for #{env_prefix} (prefixed with #{prefix_with_underscore}, case-insensitive): #{matched_fields.join(", ")}")
-          if unmatched.any?
-            Rails.logger.debug("[opdotenv] Unmatched fields (must be prefixed with #{prefix_with_underscore}, case-insensitive): #{unmatched.join(", ")}")
-            Rails.logger.debug("[opdotenv] To use these fields, rename them in 1Password to include the #{prefix_with_underscore} prefix")
-          end
+      def log_field_summary(available_fields, matched_fields, env_prefix, prefix_with_underscore)
+        Rails.logger.debug { "[opdotenv] Available fields from 1Password: #{available_fields.join(", ")}" }
+        Rails.logger.debug do
+          "[opdotenv] Matched fields for #{env_prefix} (prefixed with #{prefix_with_underscore}, case-insensitive): #{matched_fields.join(", ")}"
+        end
+      end
+
+      def log_unmatched_fields(unmatched, prefix_with_underscore)
+        Rails.logger.debug do
+          "[opdotenv] Unmatched fields (must be prefixed with #{prefix_with_underscore}, case-insensitive): #{unmatched.join(", ")}"
+        end
+        Rails.logger.debug do
+          "[opdotenv] To use these fields, rename them in 1Password to include the #{prefix_with_underscore} prefix"
         end
       end
     end

data/lib/opdotenv/connect_api_client.rb

@@ -18,27 +18,19 @@ module Opdotenv
       @env = env
     end
 
-    # Parse op:// style path or connect:// style path
-    # op://Vault/Item -> {vault: "Vault", item: "Item", field: nil}
-    # op://Vault/Item/notesPlain -> {vault: "Vault", item: "Item", field: "notesPlain"}
-    # op://Vault/Item/Section/Field -> {vault: "Vault", item: "Item", field: "Field"}
     def read(path)
       parsed = parse_path(path)
       item = get_item(parsed[:vault], parsed[:item])
-
       if parsed[:field]
-        # Read specific field
         field = find_field(item, parsed[:field])
         field ? field["value"] : ""
       else
-        # Read notesPlain for secure notes
         notes_field = item["fields"]&.find { |f| f["purpose"] == NOTES_PURPOSE || f["label"] == NOTES_PLAIN_FIELD }
         notes_field ? notes_field["value"] : ""
       end
     end
 
     def item_get(item_title, vault: nil)
-      # If vault not provided, search all vaults (requires listing vaults)
       if vault.nil?
         item = find_item_in_all_vaults(item_title)
         raise ConnectApiError, "Item '#{item_title}' not found" unless item
@@ -62,86 +54,61 @@ module Opdotenv
 
     def item_create_note(vault:, title:, notes:)
       vault_id = vault_name_to_id(vault)
-
-      payload = {
-        "vault" => {"id" => vault_id},
-        "title" => title,
-        "category" => SECURE_NOTE_CATEGORY,
-        "fields" => [
-          {
-            "purpose" => NOTES_PURPOSE,
-            "value" => notes
-          }
-        ]
-      }
-
-      response = api_request(:post, "/v1/vaults/#{vault_id}/items", payload)
+      existing = item_by_title_in_vault(vault_id, title)
+      response = if existing
+        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", notes_patch_ops(existing, notes))
+      else
+        api_request(:post, "/v1/vaults/#{vault_id}/items", {
+          "vault" => {"id" => vault_id},
+          "title" => title,
+          "category" => SECURE_NOTE_CATEGORY,
+          "fields" => [{"purpose" => NOTES_PURPOSE, "value" => notes}]
+        })
+      end
       JSON.pretty_generate(response)
     end
 
     def item_create_or_update_fields(vault:, item:, fields: {})
       vault_id = vault_name_to_id(vault)
-
-      # Try to find existing item by title
       existing = item_by_title_in_vault(vault_id, item)
-
       if existing
-        # Update using PATCH
-        fields_array = fields.map do |k, v|
-          existing_field = existing["fields"]&.find { |f| f["label"] == k.to_s }
-          if existing_field
-            {
-              "op" => "replace",
-              "path" => "/fields/#{existing_field["id"]}/value",
-              "value" => v.to_s
-            }
-          else
-            {
-              "op" => "add",
-              "path" => "/fields",
-              "value" => {
-                "type" => "CONCEALED",
-                "label" => k.to_s,
-                "value" => v.to_s
-              }
-            }
-          end
-        end
-
-        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", fields_array)
+        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", build_patch_fields(existing, fields))
       else
-        # Create new item
-        fields_array = fields.map do |k, v|
-          {
-            "type" => "CONCEALED",
-            "label" => k.to_s,
-            "value" => v.to_s
-          }
-        end
-
-        payload = {
+        api_request(:post, "/v1/vaults/#{vault_id}/items", {
           "vault" => {"id" => vault_id},
           "title" => item,
           "category" => LOGIN_CATEGORY,
-          "fields" => fields_array
-        }
-
-        api_request(:post, "/v1/vaults/#{vault_id}/items", payload)
+          "fields" => fields.map { |k, v| {"type" => "CONCEALED", "label" => k.to_s, "value" => v.to_s} }
+        })
       end
     end
 
     private
 
+    def notes_patch_ops(existing, notes)
+      field = existing["fields"]&.find { |entry| entry["purpose"] == NOTES_PURPOSE || entry["label"] == NOTES_PLAIN_FIELD }
+      if field
+        [{"op" => "replace", "path" => "/fields/#{field["id"]}/value", "value" => notes}]
+      else
+        [{"op" => "add", "path" => "/fields", "value" => {"purpose" => NOTES_PURPOSE, "value" => notes}}]
+      end
+    end
+
+    def build_patch_fields(existing, fields)
+      fields.map do |key, value|
+        existing_field = existing["fields"]&.find { |field| field["label"] == key.to_s }
+        if existing_field
+          {"op" => "replace", "path" => "/fields/#{existing_field["id"]}/value", "value" => value.to_s}
+        else
+          {"op" => "add", "path" => "/fields", "value" => {"type" => "CONCEALED", "label" => key.to_s, "value" => value.to_s}}
+        end
+      end
+    end
+
     def parse_path(path)
-      # op://Vault/Item or connect://Vault/Item
       match = path.match(/\A(?:op|connect):\/\/([^\/]+)\/([^\/]+)(?:\/(.+))?\z/)
       raise ConnectApiError, "Invalid path format: #{path}" unless match
-
-      {
-        vault: match[1],
-        item: match[2],
-        field: match[3]
-      }
+      {vault: match[1], item: match[2], field: match[3]}
     end
 
     def vault_name_to_id(vault_name)
@@ -164,20 +131,23 @@ module Opdotenv
       item = item_by_title_in_vault(vault_id, item_title)
       raise ConnectApiError, "Item '#{item_title}' not found in vault '#{vault_name}'" unless item
 
-      # Fetch full item details including fields
-      api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}")
+      item
     end
 
     def item_by_title_in_vault(vault_id, item_title)
-      # List items and find by title
-      items = api_request(:get, "/v1/vaults/#{vault_id}/items")
-      item = items.find { |i| i["title"] == item_title || i["id"] == item_title }
-      # If found by listing, fetch full details to get fields
-      if item && item["id"]
-        api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}")
-      else
-        item
-      end
+      filter = URI.encode_www_form_component(%(title eq "#{item_title.to_s.gsub('"', '\\"')}"))
+      items = api_request(:get, "/v1/vaults/#{vault_id}/items?filter=#{filter}")
+      item = Array(items).find { |entry| entry["title"] == item_title || entry["id"] == item_title }
+      return item_by_uuid(vault_id, item_title) if item.nil?
+      item["id"] ? api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}") : item
+    end
+
+    def item_by_uuid(vault_id, item_id)
+      return nil unless item_id.to_s.match?(/\A[0-9a-f-]{36}\z/i)
+
+      api_request(:get, "/v1/vaults/#{vault_id}/items/#{item_id}")
+    rescue ConnectApiError
+      nil
     end
 
     def find_field(item, field_name)
@@ -199,12 +169,8 @@ module Opdotenv
     end
 
     def build_uri(path)
-      # Validate path to prevent path traversal attacks
-      # API paths legitimately start with "/", so only check for ".."
       raise ConnectApiError, "Invalid path: #{path}" if path.include?("..")
 
-      # Use URI.join which handles path normalization safely
-      # URI.join expects base URL without trailing slash for proper joining
       base_uri = @base_url.end_with?("/") ? @base_url[0..-2] : @base_url
       normalized_path = path.start_with?("/") ? path : "/#{path}"
       URI.join(base_uri, normalized_path)
@@ -241,7 +207,7 @@ module Opdotenv
         attempts += 1
         http.request(request)
       rescue Timeout::Error, Errno::ECONNRESET
-        raise if attempts >= 2
+        raise if attempts >= 2 || !request.is_a?(Net::HTTP::Get)
         sleep 0.2
         retry
       end
@@ -251,9 +217,13 @@ module Opdotenv
       code = response.code.to_i
 
       case code
-      when 200, 204
-        return {} if response.body.empty? || code == 204
-        JSON.parse(response.body)
+      when 200..299
+        return {} if response.body.to_s.empty? || code == 204
+        begin
+          JSON.parse(response.body)
+        rescue JSON::ParserError
+          raise ConnectApiError, "API error (#{code}): Invalid JSON response"
+        end
       when 401
         raise ConnectApiError, "Unauthorized: Invalid or missing access token"
       when 403
@@ -263,24 +233,10 @@ module Opdotenv
       when 500..599
         raise ConnectApiError, "API error (#{code}): Server error"
       else
-        # Extract safe error message without leaking response body
-        safe_message = extract_safe_error_message(response)
-        raise ConnectApiError, "API error (#{code}): #{safe_message}"
+        raise ConnectApiError, "API error (#{code}): Request failed"
       end
     end
 
-    def extract_safe_error_message(response)
-      # Only extract structured error messages from JSON responses
-      # Never include raw response body to avoid leaking secrets
-
-      parsed = JSON.parse(response.body)
-      # Only return known safe fields that are typically error messages
-      parsed["message"] || parsed["error"] || "Request failed"
-    rescue JSON::ParserError
-      # For non-JSON responses, return generic message to avoid leaking body
-      "Request failed"
-    end
-
     def validate_url(url)
       uri = URI.parse(url)
       unless ["http", "https"].include?(uri.scheme)

data/lib/opdotenv/exporter.rb

@@ -18,7 +18,6 @@ module Opdotenv
 
       # Check if path matches format patterns (Secure Note) or regular item (fields)
       if FormatInferrer.matches_format_pattern?(item_name)
-        # Create Secure Note
         field_type ||= FormatInferrer.infer_from_name(item_name) || :dotenv
         content = serialize_by_format(data, field_type)
         client.item_create_note(vault: vault, title: item_name, notes: content)

data/lib/opdotenv/format_inferrer.rb

@@ -3,18 +3,25 @@ module Opdotenv
   module FormatInferrer
     module_function
 
-    DOTENV_PATTERN = /\.env\.?/
     JSON_EXTENSIONS = [".json"].freeze
     YAML_EXTENSIONS = [".yaml", ".yml"].freeze
 
     def infer_from_name(name)
-      return :dotenv if name.match?(DOTENV_PATTERN)
-      return :json if JSON_EXTENSIONS.any? { |ext| name.end_with?(ext) }
-      return :yaml if YAML_EXTENSIONS.any? { |ext| name.end_with?(ext) }
+      base = File.basename(name.to_s)
+      return :dotenv if dotenv_basename?(base)
+      return :json if JSON_EXTENSIONS.any? { |ext| base.end_with?(ext) }
+      return :yaml if YAML_EXTENSIONS.any? { |ext| base.end_with?(ext) }
 
       nil
     end
 
+    def dotenv_basename?(base)
+      base == ".env" ||
+        base.start_with?(".env.") ||
+        base.include?(" .env.") ||
+        base.end_with?(" .env")
+    end
+
     def matches_format_pattern?(name)
       !infer_from_name(name).nil?
     end

data/lib/opdotenv/loader.rb

@@ -25,24 +25,25 @@ module Opdotenv
       raw_json = client.item_get(item, vault: vault)
       item_hash = parse_json_safe(raw_json)
 
-      # Only process fields from the 1Password item, filter out empty values
       item_hash["fields"]&.each_with_object({}) do |field, env_data|
-        # Only include actual fields from the item
-        next unless field.is_a?(Hash)
+        entry = field_env_entry(field)
+        next unless entry
 
-        # Strip whitespace from label and treat empty strings as nil
-        label = (field["label"] || field["id"])&.strip
-        next if label.nil? || label.empty?
+        env_data[entry[:key]] = entry[:value]
+      end || {}
+    end
 
-        # Skip notesPlain when fetching all fields
-        next if field["purpose"] == NOTES_PURPOSE
+    def self.field_env_entry(field)
+      return nil unless field.is_a?(Hash)
 
-        # Get the value and filter out empty values
-        value = field["value"]
-        next if value.nil? || (value.is_a?(String) && value.strip.empty?)
+      label = (field["label"] || field["id"])&.strip
+      return nil if label.nil? || label.empty?
+      return nil if field["purpose"] == NOTES_PURPOSE
 
-        env_data[label.to_s] = value.to_s
-      end || {}
+      value = field["value"]
+      return nil if value.nil? || (value.is_a?(String) && value.strip.empty?)
+
+      {key: label.to_s, value: value.to_s}
     end
 
     def self.build_field_path(path, field_name)

data/lib/opdotenv/op_client.rb

@@ -27,33 +27,48 @@ module Opdotenv
     end
 
     def item_create_note(vault:, title:, notes:)
-      # Create a Secure Note with given title and notesPlain
-      # Use shell escaping to prevent injection
-      args = [
-        @cli_path, "item", "create",
-        "--category", SECURE_NOTE_CATEGORY,
-        "--title", title,
-        "--vault", vault,
-        "#{NOTES_PLAIN_FIELD}=#{notes}"
-      ]
-      capture(args)
+      notes_field = {"id" => NOTES_PLAIN_FIELD, "type" => "STRING", "purpose" => "NOTES", "value" => notes}
+      if item_exists?(title, vault: vault)
+        payload = JSON.parse(item_get(title, vault: vault))
+        existing = payload["fields"]&.find { |field|
+          field["id"] == NOTES_PLAIN_FIELD || field["purpose"] == "NOTES" || field["label"] == NOTES_PLAIN_FIELD
+        }
+        if existing
+          existing["value"] = notes
+        else
+          payload["fields"] ||= []
+          payload["fields"] << notes_field
+        end
+        capture([@cli_path, "item", "edit", title, "--vault", vault], stdin_data: JSON.generate(payload))
+      else
+        args = [
+          @cli_path, "item", "create",
+          "--category", SECURE_NOTE_CATEGORY,
+          "--title", title,
+          "--vault", vault,
+          "-"
+        ]
+        capture(args, stdin_data: JSON.generate({"fields" => [notes_field]}))
+      end
     end
 
     def item_create_or_update_fields(vault:, item:, fields: {})
       exists = item_exists?(item, vault: vault)
-      if exists
-        fields.each do |k, v|
-          # Use shell escaping to prevent injection
-          field_arg = "#{k}=#{v}"
-          capture([@cli_path, "item", "edit", item, "--vault", vault, "--set", field_arg])
+      payload = exists ? JSON.parse(item_get(item, vault: vault)) : {"category" => LOGIN_CATEGORY, "fields" => []}
+      fields.each do |key, value|
+        field = payload["fields"].find { |entry| entry["label"] == key.to_s || entry["id"] == key.to_s }
+        if field
+          field["value"] = value.to_s
+        else
+          payload["fields"] << {"type" => "CONCEALED", "label" => key.to_s, "value" => value.to_s}
         end
+      end
+      args = if exists
+        [@cli_path, "item", "edit", item, "--vault", vault]
       else
-        args = [@cli_path, "item", "create", "--title", item, "--vault", vault]
-        fields.each do |k, v|
-          args += ["--set", "#{k}=#{v}"]
-        end
-        capture(args)
+        [@cli_path, "item", "create", "--title", item, "--vault", vault, "-"]
       end
+      capture(args, stdin_data: JSON.generate(payload))
     end
 
     private
@@ -70,10 +85,10 @@ module Opdotenv
       raise ArgumentError, "Invalid path format: #{path.inspect}. Must start with 'op://'"
     end
 
-    def capture(args)
+    def capture(args, **options)
       # Use exec-style array to prevent shell injection
       # Open3.capture2e captures both stdout and stderr, and properly returns exit status
-      out, status = Open3.capture2e(*args)
+      out, status = Open3.capture2e(*args, **options)
 
       # For JSON output, try to parse even if exit code is non-zero
       # Some op commands may return non-zero but still output valid JSON

data/lib/opdotenv/parsers/dotenv_parser.rb

@@ -2,26 +2,33 @@ module Opdotenv
   module Parsers
     class DotenvParser
       def self.parse(text)
-        env = {}
-        text.to_s.each_line do |line|
-          line = line.strip
-          next if line.empty? || line.start_with?("#")
-          # Support KEY=VALUE and KEY="VALUE"; ignore export prefix
-          line = line.sub(/^export\s+/, "")
-          if (m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\z/))
-            key = m[1]
-            raw = m[2]
-            value = if raw.start_with?("\"") && raw.end_with?("\"")
-              raw[1..-2].gsub('\\"', '"')
-            elsif raw.start_with?("'") && raw.end_with?("'")
-              raw[1..-2]
-            else
-              raw
-            end
-            env[key] = value
-          end
+        text.to_s.each_line.with_object({}) do |line, env|
+          entry = parse_line(line)
+          next unless entry
+
+          env[entry[:key]] = entry[:value]
+        end
+      end
+
+      def self.parse_line(line)
+        line = line.strip
+        return nil if line.empty? || line.start_with?("#")
+
+        line = line.sub(/^export\s+/, "")
+        match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\z/)
+        return nil unless match
+
+        {key: match[1], value: unquote_value(match[2])}
+      end
+
+      def self.unquote_value(raw)
+        if raw.start_with?("\"") && raw.end_with?("\"")
+          raw[1..-2].gsub('\\"', '"')
+        elsif raw.start_with?("'") && raw.end_with?("'")
+          raw[1..-2]
+        else
+          raw
         end
-        env
       end
     end
   end

data/lib/opdotenv/source_parser.rb

@@ -19,18 +19,17 @@ module Opdotenv
 
       path = source.to_s
       _, item = parse_op_path(path)
-
-      # Extract item name and potential field name
-      # Handle paths like "op://Vault/Item" or "op://Vault/Item Name/field"
       item_parts = item.split("/")
       item_name = item_parts.first
       field_name = (item_parts.length > 1) ? item_parts[1] : nil
 
-      # First check if field name is provided with extension in the path
+      build_parsed_source(path, item_name, field_name)
+    end
+
+    def build_parsed_source(path, item_name, field_name)
       if field_name
         field_type = FormatInferrer.infer_from_name(field_name)
         {path: path, field_name: field_name, field_type: field_type}
-      # If no field name in path, infer from item name patterns
       elsif (field_type = FormatInferrer.infer_from_name(item_name))
         {path: path, field_name: NOTES_PLAIN_FIELD, field_type: field_type}
       else
@@ -66,6 +65,6 @@ module Opdotenv
       }
     end
 
-    module_function :normalize_hash
+    module_function :normalize_hash, :build_parsed_source
   end
 end

data/lib/opdotenv/version.rb

@@ -1,3 +1,3 @@
 module Opdotenv
-  VERSION = "1.0.3"
+  VERSION = "1.0.6"
 end

data/lib/opdotenv.rb

@@ -1,6 +1,5 @@
 require "json"
 require "yaml"
-require "shellwords"
 
 require_relative "opdotenv/version"
 require_relative "opdotenv/format_inferrer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: opdotenv
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.6
 platform: ruby
 authors:
 - Andrei Makarov
@@ -15,17 +15,17 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
-  type: :runtime
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -58,75 +58,131 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3'
 - !ruby/object:Gem::Dependency
-  name: simplecov
+  name: polyrun
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+- !ruby/object:Gem::Dependency
+  name: standard
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.52'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.52'
 - !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
+  name: standard-custom
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: simplecov-cobertura
+  name: standard-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '1.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '1.8'
 - !ruby/object:Gem::Dependency
-  name: standard
+  name: standard-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '1.5'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '1.5'
 - !ruby/object:Gem::Dependency
-  name: standard-performance
+  name: standard-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.33'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.33'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+- !ruby/object:Gem::Dependency
+  name: rubocop-thread_safety
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0.7'
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement
@@ -239,14 +295,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Load and export environment variables with 1Password CLI or Connect API
 test_files: []