opdotenv 1.0.5 → 1.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 681b84ce04a08dea4ef5bb4645ecf47071922f63288f5d6b26fcc558d2b181fd
-  data.tar.gz: d6706fb654448e9d4efa404d373d54d5f9ef5b5f5553a73c5335c28b6a7f9508
+  metadata.gz: 9bbc6ae3316e89e48c9c52e3f3aa33f3a3572217eab08b88ddc98283989b7f04
+  data.tar.gz: e964c986cd6676f4a0f3d0c3c33f633b520c9f277b6030f79a407f0db3cd8fdd
 SHA512:
-  metadata.gz: 43741125e5322870b2f11d57d6b7c2a1d6ea695d69209b93938a546b5ac44f785064b21cdaf2ca6ead5a232b5e36d6d0035f90a4fa9e2f668af0b53aa1c34f8d
-  data.tar.gz: 0b1855b8e5804b98dd8bf4936a218a69bfb415073e38b78f25102744b979674f9afda9baec9570c4dbf67deeee46e226be78073ab9a51105f9e989e9a2f8a522
+  metadata.gz: e1c8b865089d2a6a2463f7ebc5edffd60566a826fb9667c792ef02c61c113a309a892adf2fbb5ade5115868fcc52b58919a15b79ecb3e84d3017531a6aebb678
+  data.tar.gz: 2e308264ed8c9aadbd846daef1c9804f98f8571cffd902be3fece3613b586d5240edffa4d0d2dffa2008573a3280e6994f5089635628a4bc1a4a6af1d70be2ff

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # CHANGELOG
 
+## 1.0.6 (2026-11-03)
+
+- Keep exported secrets out of 1Password CLI command arguments.
+- Upsert Secure Note exports on create and edit for both `op` CLI and Connect.
+- Use dedicated configuration items for CLI exports; existing-item updates cannot preserve passkeys.
+- Infer export formats correctly when no override is supplied; match `.env` basenames only.
+- Accept successful Connect API creation responses and avoid repeating writes after timeouts.
+- Filter Connect item lookups by title and omit server response values from error messages.
+- Fetch item details once per read after the filtered list.
+- Cancel release preparation when confirmation input is closed.
+
 ## 1.0.5 (2026-07-06)
 
 - Improve `OPDOTENV_DEBUG` field summary logging in Anyway Config integration to build messages only when Rails debug logging is active

data/README.md

@@ -1,15 +1,9 @@
 # opdotenv
 
-[![Gem Version](https://badge.fury.io/rb/opdotenv.svg?v=1.0.3)](https://badge.fury.io/rb/opdotenv) [![Test Status](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/opdotenv.rb/graph/badge.svg?token=U4FMVZGO8R)](https://codecov.io/gh/amkisko/opdotenv.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_opdotenv.rb&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=amkisko_opdotenv.rb)
+[![Gem Version](https://badge.fury.io/rb/opdotenv.svg?v=1.0.6)](https://badge.fury.io/rb/opdotenv) [![Test Status](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/opdotenv.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/opdotenv.rb/graph/badge.svg?token=U4FMVZGO8R)](https://app.codecov.io/github/amkisko/opdotenv.rb) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=amkisko_opdotenv.rb&metric=alert_status)](https://sonarcloud.io/project/overview?id=amkisko_opdotenv.rb)
 
 Load environment variables from 1Password using the `op` CLI or 1Password Connect Server API. Supports dotenv, JSON, and YAML formats.
 
-Sponsored by [Kisko Labs](https://www.kiskolabs.com).
-
-<a href="https://www.kiskolabs.com">
-  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
-</a>
-
 ## Installation
 
 Add to your Gemfile:
@@ -26,7 +20,7 @@ Choose one:
   - You can configure a custom path via `OP_CLI_PATH` or `OPDOTENV_CLI_PATH` environment variables, or via Rails config (see below)
 - **1Password Connect Server** - set `OP_CONNECT_URL` and `OP_CONNECT_TOKEN` environment variables
 
-Ruby 2.7+ supported.
+Ruby 3.4+ required.
 
 ## Rails
 
@@ -42,16 +36,7 @@ Rails.application.configure do
 end
 ```
 
-Format is automatically inferred from item name or field name:
-- `.env.*` → dotenv format
-- `*.json` → JSON format
-- `*.yaml` or `*.yml` → YAML format
-- Other items → load all fields without parsing
-
-You can also specify the field name with extension in the path:
-- `op://Vault/Item Name/config.json` → uses field `config.json` as JSON
-- `op://Vault/Item Name/production.json` → uses field `production.json` as JSON
-- `op://Vault/Item Name/.env.development` → uses field `.env.development` as dotenv
+Format is inferred from the item or field basename (see [Supported formats](#supported-formats)). Field names with extensions work in the path, for example `op://Vault/Item Name/config.json`.
 
 ### 1Password Connect
 
@@ -135,16 +120,15 @@ class DatabaseConfig < Anyway::Config
 end
 ```
 
-### Conditional Loading (Recommended for Security)
+### Conditional loading
 
-For better security, only load from 1Password in development/test environments:
+Load from 1Password only in local or development environments:
 
 ```ruby
 class TestConfig < Anyway::Config
   config_name :test
   attr_config :enabled, :sample
 
-  # Only load from 1Password in local/development environments
   if Rails.env.local?
     loader_options opdotenv: {
       path: "op://Employee/.env.test"
@@ -153,7 +137,7 @@ class TestConfig < Anyway::Config
 end
 ```
 
-This ensures that production environments won't attempt to load secrets from 1Password, aligning with the [production recommendations](#environment-recommendation).
+See [Environment recommendation](#environment-recommendation).
 
 ### Loading All Fields from an Item
 
@@ -204,6 +188,8 @@ Dotenv.load(".env", ".env.development")
 
 ## Export to 1Password
 
+Use dedicated configuration items for exports through the `op` CLI. Export values are sent through standard input to keep them out of process arguments. Updating an existing item uses a JSON template and does not support items containing passkeys: 1Password warns that template updates overwrite passkeys. Do not export into a login item that contains a passkey. See the [1Password item edit documentation](https://www.1password.dev/cli/reference/management-commands/item#edit-an-item-using-a-template).
+
 ### CLI
 
 ```bash
@@ -235,50 +221,33 @@ Opdotenv::Exporter.export(
 
 ## Supported formats
 
-Format is automatically inferred from item name or field name:
-- `.env.*` → dotenv format (`KEY=VALUE`)
-- `*.json` → JSON format (nested structures flattened with underscores)
-- `*.yaml` or `*.yml` → YAML format (nested structures flattened with underscores)
-- Other items → load all fields without parsing
+Format is inferred from the item or field basename:
+- `.env` or `.env.*`: dotenv (`KEY=VALUE`)
+- `*.json`: JSON (nested keys flattened with underscores)
+- `*.yaml` or `*.yml`: YAML (nested keys flattened with underscores)
+- Other items: load all fields without parsing
 
-Field names can be specified with extensions in the path:
-- `op://Vault/Item Name/config.json` → loads field `config.json` as JSON
-- `op://Vault/Item Name/production.json` → loads field `production.json` as JSON
-- `op://Vault/Item Name/.env.development` → loads field `.env.development` as dotenv
-
-For advanced usage, you can explicitly specify `field_name` and `field_type` in the API.
+Field names with extensions work in the path, for example `op://Vault/Item Name/config.json`. Callers can also pass `field_name` and `field_type` to the API.
 
 ## Security
 
-### Environment Recommendation
-
-**⚠️ This gem is recommended for development and test environments only.**
+### Environment recommendation
 
-For production environments, we recommend using dedicated secret management solutions that integrate with your infrastructure:
+Use this gem in development and test. For production, prefer the secret store that matches the host:
 
-- **Kubernetes**: Use [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) or [External Secrets Operator](https://external-secrets.io/) with providers like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault
-- **AWS**: Use [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
-- **Azure**: Use [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault)
-- **GCP**: Use [Google Secret Manager](https://cloud.google.com/secret-manager)
+- **Kubernetes**: [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) or [External Secrets Operator](https://external-secrets.io/) with AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault
+- **AWS**: [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
+- **Azure**: [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault)
+- **GCP**: [Google Secret Manager](https://cloud.google.com/secret-manager)
 
-Provision secrets through infrastructure-as-code tools:
-- **Helm** (Kubernetes): Use `helm secrets` or external secrets operator
-- **Terraform**: Use `aws_secretsmanager_secret`, `azurerm_key_vault_secret`, or `google_secret_manager_secret`
-- **Bicep** (Azure): Use `Microsoft.KeyVault/vaults` resources
+Provision through infrastructure tools such as Helm, Terraform, or Bicep when that matches the host.
 
-These solutions provide:
-- Better audit trails and access controls
-- Integration with IAM/RBAC systems
-- Automatic secret rotation
-- Compliance with security standards
-- No dependency on external CLI tools or API servers
+### Security considerations
 
-### Security Considerations
-
-- **CLI mode**: Secrets fetched via authenticated `op` CLI session.
-- **Connect API mode**: Secrets fetched via HTTPS. Ensure tokens are secure.
-- The library does not persist secrets in memory or on disk.
-- Always verify 1Password CLI or Connect server is up to date and authenticated.
+- **CLI mode**: Secrets fetched via an authenticated `op` CLI session.
+- **Connect API mode**: Secrets fetched via HTTPS. Keep tokens out of logs and process arguments.
+- The library does not persist secrets in memory beyond the load, or on disk.
+- Keep the 1Password CLI or Connect server current and authenticated.
 
 ### Code Locations for Security Review
 
@@ -289,7 +258,7 @@ For security-sensitive applications, developers should review where this gem rea
 - **`lib/opdotenv/op_client.rb`**:
   - `read(path)` - Executes `op read` command to fetch a single field value
   - `item_get(item, vault:)` - Executes `op item get` command to fetch all item data as JSON
-  - `capture(args)` - Executes shell commands via `IO.popen` (array arguments, no shell interpretation)
+  - `capture(args)` - Runs the CLI via `Open3.capture2e` (array arguments, optional stdin)
 
 #### Reading Secrets (ConnectApiClient - API mode)
 
@@ -297,7 +266,7 @@ For security-sensitive applications, developers should review where this gem rea
   - `read(path)` - Makes HTTP GET request to fetch field or notesPlain content
   - `item_get(item_title, vault:)` - Searches and fetches item data via API
   - `get_item(vault_name, item_title)` - Fetches full item details including all fields
-  - `item_by_title_in_vault(vault_id, item_title)` - Lists items and fetches by title
+  - `item_by_title_in_vault(vault_id, item_title)` - Filters items by title and fetches full details
   - `list_vaults()` - Lists all accessible vaults (uses `api_request(:get, "/v1/vaults")`)
   - `vault_name_to_id(vault_name)` - Resolves vault names to IDs (cached)
   - `api_request(method, path, body)` - All HTTP requests go through this method
@@ -330,14 +299,14 @@ For security-sensitive applications, developers should review where this gem rea
 - **`lib/opdotenv/parsers/json_parser.rb`** - Parses and flattens JSON structures
 - **`lib/opdotenv/parsers/yaml_parser.rb`** - Parses YAML (safe_load with aliases: false)
 
-#### Data Flow
+#### Data flow
 
-1. **Configuration** → Rails config or direct API calls
-2. **Path Parsing** → `SourceParser.parse()` extracts vault/item/field from path
-3. **Client Selection** → `ClientFactory.create()` chooses CLI or API client
-4. **Secret Fetching** → Client reads from 1Password (CLI command or HTTP request)
-5. **Parsing** → Format-specific parser converts to key-value pairs
-6. **Environment Merge** → Secrets merged into `ENV` or provided hash
+1. **Configuration**: Rails config or direct API calls
+2. **Path parsing**: `SourceParser.parse()` extracts vault/item/field from path
+3. **Client selection**: `ClientFactory.create()` chooses CLI or API client
+4. **Secret fetching**: Client reads from 1Password (CLI command or HTTP request)
+5. **Parsing**: Format-specific parser converts to key-value pairs
+6. **Environment merge**: Secrets merged into `ENV` or provided hash
 
 All secret data flows through these code paths. No secrets are persisted to disk or logged (except explicit error messages).
 
@@ -345,7 +314,7 @@ All secret data flows through these code paths. No secrets are persisted to disk
 
 ```bash
 bundle install
-bundle exec rspec
+bundle exec polyrun parallel-rspec --workers 5 --merge-failures
 bundle exec rbs validate
 bundle exec standardrb --fix
 ```
@@ -368,6 +337,27 @@ Review policy:
 
 If you discover a security vulnerability, please report it responsibly. See [SECURITY.md](SECURITY.md) for details.
 
+## Links
+
+- [GitHub](https://github.com/amkisko/opdotenv.rb)
+- [GitLab](https://gitlab.com/amkisko/opdotenv.rb)
+- [RubyGems](https://rubygems.org/gems/opdotenv)
+- [Versions Atom](https://rubygems.org/gems/opdotenv/versions.atom) (feed id `9869611634128`)
+- [libraries.io](https://libraries.io/rubygems/opdotenv)
+- [Deps.dev](https://deps.dev/rubygems/opdotenv)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_opdotenv.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/opdotenv.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/opdotenv.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/opdotenv.rb)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+
+## Sponsors
+
+Sponsored by [Kisko Labs](https://www.kiskolabs.com).
+
+<a href="https://www.kiskolabs.com">
+  <img src="kisko.svg" width="200" alt="Sponsored by Kisko Labs" />
+</a>

data/bin/opdotenv

@@ -27,7 +27,7 @@ when "export"
   end.parse!(ARGV)
   abort("--path and --file required") unless path && file
   # Infer format from file extension if not provided
-  field_type ||= infer_format_from_file(file)
+  field_type ||= Opdotenv::FormatInferrer.infer_from_name(file) || :dotenv
   text = File.read(file)
   data = Opdotenv::Loader.parse_by_format(text, field_type)
   Opdotenv::Exporter.export(path: path, data: data, field_type: field_type)
@@ -35,11 +35,3 @@ else
   warn "Usage: opdotenv (read|export) ..."
   exit 1
 end
-
-def infer_format_from_file(file)
-  case File.extname(file)
-  when ".json" then :json
-  when ".yaml", ".yml" then :yaml
-  else :dotenv
-  end
-end

data/lib/opdotenv/connect_api_client.rb

@@ -18,27 +18,19 @@ module Opdotenv
       @env = env
     end
 
-    # Parse op:// style path or connect:// style path
-    # op://Vault/Item -> {vault: "Vault", item: "Item", field: nil}
-    # op://Vault/Item/notesPlain -> {vault: "Vault", item: "Item", field: "notesPlain"}
-    # op://Vault/Item/Section/Field -> {vault: "Vault", item: "Item", field: "Field"}
     def read(path)
       parsed = parse_path(path)
       item = get_item(parsed[:vault], parsed[:item])
-
       if parsed[:field]
-        # Read specific field
         field = find_field(item, parsed[:field])
         field ? field["value"] : ""
       else
-        # Read notesPlain for secure notes
         notes_field = item["fields"]&.find { |f| f["purpose"] == NOTES_PURPOSE || f["label"] == NOTES_PLAIN_FIELD }
         notes_field ? notes_field["value"] : ""
       end
     end
 
     def item_get(item_title, vault: nil)
-      # If vault not provided, search all vaults (requires listing vaults)
       if vault.nil?
         item = find_item_in_all_vaults(item_title)
         raise ConnectApiError, "Item '#{item_title}' not found" unless item
@@ -62,88 +54,61 @@ module Opdotenv
 
     def item_create_note(vault:, title:, notes:)
       vault_id = vault_name_to_id(vault)
-
-      payload = {
-        "vault" => {"id" => vault_id},
-        "title" => title,
-        "category" => SECURE_NOTE_CATEGORY,
-        "fields" => [
-          {
-            "purpose" => NOTES_PURPOSE,
-            "value" => notes
-          }
-        ]
-      }
-
-      response = api_request(:post, "/v1/vaults/#{vault_id}/items", payload)
+      existing = item_by_title_in_vault(vault_id, title)
+      response = if existing
+        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", notes_patch_ops(existing, notes))
+      else
+        api_request(:post, "/v1/vaults/#{vault_id}/items", {
+          "vault" => {"id" => vault_id},
+          "title" => title,
+          "category" => SECURE_NOTE_CATEGORY,
+          "fields" => [{"purpose" => NOTES_PURPOSE, "value" => notes}]
+        })
+      end
       JSON.pretty_generate(response)
     end
 
     def item_create_or_update_fields(vault:, item:, fields: {})
       vault_id = vault_name_to_id(vault)
-
-      # Try to find existing item by title
       existing = item_by_title_in_vault(vault_id, item)
-
       if existing
-        fields_array = build_patch_fields(existing, fields)
-        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", fields_array)
+        api_request(:patch, "/v1/vaults/#{vault_id}/items/#{existing["id"]}", build_patch_fields(existing, fields))
       else
-        # Create new item
-        fields_array = fields.map do |k, v|
-          {
-            "type" => "CONCEALED",
-            "label" => k.to_s,
-            "value" => v.to_s
-          }
-        end
-
-        payload = {
+        api_request(:post, "/v1/vaults/#{vault_id}/items", {
           "vault" => {"id" => vault_id},
           "title" => item,
           "category" => LOGIN_CATEGORY,
-          "fields" => fields_array
-        }
-
-        api_request(:post, "/v1/vaults/#{vault_id}/items", payload)
+          "fields" => fields.map { |k, v| {"type" => "CONCEALED", "label" => k.to_s, "value" => v.to_s} }
+        })
       end
     end
 
     private
 
+    def notes_patch_ops(existing, notes)
+      field = existing["fields"]&.find { |entry| entry["purpose"] == NOTES_PURPOSE || entry["label"] == NOTES_PLAIN_FIELD }
+      if field
+        [{"op" => "replace", "path" => "/fields/#{field["id"]}/value", "value" => notes}]
+      else
+        [{"op" => "add", "path" => "/fields", "value" => {"purpose" => NOTES_PURPOSE, "value" => notes}}]
+      end
+    end
+
     def build_patch_fields(existing, fields)
       fields.map do |key, value|
         existing_field = existing["fields"]&.find { |field| field["label"] == key.to_s }
         if existing_field
-          {
-            "op" => "replace",
-            "path" => "/fields/#{existing_field["id"]}/value",
-            "value" => value.to_s
-          }
+          {"op" => "replace", "path" => "/fields/#{existing_field["id"]}/value", "value" => value.to_s}
         else
-          {
-            "op" => "add",
-            "path" => "/fields",
-            "value" => {
-              "type" => "CONCEALED",
-              "label" => key.to_s,
-              "value" => value.to_s
-            }
-          }
+          {"op" => "add", "path" => "/fields", "value" => {"type" => "CONCEALED", "label" => key.to_s, "value" => value.to_s}}
         end
       end
     end
 
     def parse_path(path)
-      # op://Vault/Item or connect://Vault/Item
       match = path.match(/\A(?:op|connect):\/\/([^\/]+)\/([^\/]+)(?:\/(.+))?\z/)
       raise ConnectApiError, "Invalid path format: #{path}" unless match
-
-      {
-        vault: match[1],
-        item: match[2],
-        field: match[3]
-      }
+      {vault: match[1], item: match[2], field: match[3]}
     end
 
     def vault_name_to_id(vault_name)
@@ -166,20 +131,23 @@ module Opdotenv
       item = item_by_title_in_vault(vault_id, item_title)
       raise ConnectApiError, "Item '#{item_title}' not found in vault '#{vault_name}'" unless item
 
-      # Fetch full item details including fields
-      api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}")
+      item
     end
 
     def item_by_title_in_vault(vault_id, item_title)
-      # List items and find by title
-      items = api_request(:get, "/v1/vaults/#{vault_id}/items")
-      item = items.find { |i| i["title"] == item_title || i["id"] == item_title }
-      # If found by listing, fetch full details to get fields
-      if item && item["id"]
-        api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}")
-      else
-        item
-      end
+      filter = URI.encode_www_form_component(%(title eq "#{item_title.to_s.gsub('"', '\\"')}"))
+      items = api_request(:get, "/v1/vaults/#{vault_id}/items?filter=#{filter}")
+      item = Array(items).find { |entry| entry["title"] == item_title || entry["id"] == item_title }
+      return item_by_uuid(vault_id, item_title) if item.nil?
+      item["id"] ? api_request(:get, "/v1/vaults/#{vault_id}/items/#{item["id"]}") : item
+    end
+
+    def item_by_uuid(vault_id, item_id)
+      return nil unless item_id.to_s.match?(/\A[0-9a-f-]{36}\z/i)
+
+      api_request(:get, "/v1/vaults/#{vault_id}/items/#{item_id}")
+    rescue ConnectApiError
+      nil
     end
 
     def find_field(item, field_name)
@@ -201,12 +169,8 @@ module Opdotenv
     end
 
     def build_uri(path)
-      # Validate path to prevent path traversal attacks
-      # API paths legitimately start with "/", so only check for ".."
       raise ConnectApiError, "Invalid path: #{path}" if path.include?("..")
 
-      # Use URI.join which handles path normalization safely
-      # URI.join expects base URL without trailing slash for proper joining
       base_uri = @base_url.end_with?("/") ? @base_url[0..-2] : @base_url
       normalized_path = path.start_with?("/") ? path : "/#{path}"
       URI.join(base_uri, normalized_path)
@@ -243,7 +207,7 @@ module Opdotenv
         attempts += 1
         http.request(request)
       rescue Timeout::Error, Errno::ECONNRESET
-        raise if attempts >= 2
+        raise if attempts >= 2 || !request.is_a?(Net::HTTP::Get)
         sleep 0.2
         retry
       end
@@ -253,9 +217,13 @@ module Opdotenv
       code = response.code.to_i
 
       case code
-      when 200, 204
-        return {} if response.body.empty? || code == 204
-        JSON.parse(response.body)
+      when 200..299
+        return {} if response.body.to_s.empty? || code == 204
+        begin
+          JSON.parse(response.body)
+        rescue JSON::ParserError
+          raise ConnectApiError, "API error (#{code}): Invalid JSON response"
+        end
       when 401
         raise ConnectApiError, "Unauthorized: Invalid or missing access token"
       when 403
@@ -265,24 +233,10 @@ module Opdotenv
       when 500..599
         raise ConnectApiError, "API error (#{code}): Server error"
       else
-        # Extract safe error message without leaking response body
-        safe_message = extract_safe_error_message(response)
-        raise ConnectApiError, "API error (#{code}): #{safe_message}"
+        raise ConnectApiError, "API error (#{code}): Request failed"
       end
     end
 
-    def extract_safe_error_message(response)
-      # Only extract structured error messages from JSON responses
-      # Never include raw response body to avoid leaking secrets
-
-      parsed = JSON.parse(response.body)
-      # Only return known safe fields that are typically error messages
-      parsed["message"] || parsed["error"] || "Request failed"
-    rescue JSON::ParserError
-      # For non-JSON responses, return generic message to avoid leaking body
-      "Request failed"
-    end
-
     def validate_url(url)
       uri = URI.parse(url)
       unless ["http", "https"].include?(uri.scheme)

data/lib/opdotenv/exporter.rb

@@ -18,7 +18,6 @@ module Opdotenv
 
       # Check if path matches format patterns (Secure Note) or regular item (fields)
       if FormatInferrer.matches_format_pattern?(item_name)
-        # Create Secure Note
         field_type ||= FormatInferrer.infer_from_name(item_name) || :dotenv
         content = serialize_by_format(data, field_type)
         client.item_create_note(vault: vault, title: item_name, notes: content)

data/lib/opdotenv/format_inferrer.rb

@@ -3,18 +3,25 @@ module Opdotenv
   module FormatInferrer
     module_function
 
-    DOTENV_PATTERN = /\.env\.?/
     JSON_EXTENSIONS = [".json"].freeze
     YAML_EXTENSIONS = [".yaml", ".yml"].freeze
 
     def infer_from_name(name)
-      return :dotenv if name.match?(DOTENV_PATTERN)
-      return :json if JSON_EXTENSIONS.any? { |ext| name.end_with?(ext) }
-      return :yaml if YAML_EXTENSIONS.any? { |ext| name.end_with?(ext) }
+      base = File.basename(name.to_s)
+      return :dotenv if dotenv_basename?(base)
+      return :json if JSON_EXTENSIONS.any? { |ext| base.end_with?(ext) }
+      return :yaml if YAML_EXTENSIONS.any? { |ext| base.end_with?(ext) }
 
       nil
     end
 
+    def dotenv_basename?(base)
+      base == ".env" ||
+        base.start_with?(".env.") ||
+        base.include?(" .env.") ||
+        base.end_with?(" .env")
+    end
+
     def matches_format_pattern?(name)
       !infer_from_name(name).nil?
     end

data/lib/opdotenv/op_client.rb

@@ -27,33 +27,48 @@ module Opdotenv
     end
 
     def item_create_note(vault:, title:, notes:)
-      # Create a Secure Note with given title and notesPlain
-      # Use shell escaping to prevent injection
-      args = [
-        @cli_path, "item", "create",
-        "--category", SECURE_NOTE_CATEGORY,
-        "--title", title,
-        "--vault", vault,
-        "#{NOTES_PLAIN_FIELD}=#{notes}"
-      ]
-      capture(args)
+      notes_field = {"id" => NOTES_PLAIN_FIELD, "type" => "STRING", "purpose" => "NOTES", "value" => notes}
+      if item_exists?(title, vault: vault)
+        payload = JSON.parse(item_get(title, vault: vault))
+        existing = payload["fields"]&.find { |field|
+          field["id"] == NOTES_PLAIN_FIELD || field["purpose"] == "NOTES" || field["label"] == NOTES_PLAIN_FIELD
+        }
+        if existing
+          existing["value"] = notes
+        else
+          payload["fields"] ||= []
+          payload["fields"] << notes_field
+        end
+        capture([@cli_path, "item", "edit", title, "--vault", vault], stdin_data: JSON.generate(payload))
+      else
+        args = [
+          @cli_path, "item", "create",
+          "--category", SECURE_NOTE_CATEGORY,
+          "--title", title,
+          "--vault", vault,
+          "-"
+        ]
+        capture(args, stdin_data: JSON.generate({"fields" => [notes_field]}))
+      end
     end
 
     def item_create_or_update_fields(vault:, item:, fields: {})
       exists = item_exists?(item, vault: vault)
-      if exists
-        fields.each do |k, v|
-          # Use shell escaping to prevent injection
-          field_arg = "#{k}=#{v}"
-          capture([@cli_path, "item", "edit", item, "--vault", vault, "--set", field_arg])
+      payload = exists ? JSON.parse(item_get(item, vault: vault)) : {"category" => LOGIN_CATEGORY, "fields" => []}
+      fields.each do |key, value|
+        field = payload["fields"].find { |entry| entry["label"] == key.to_s || entry["id"] == key.to_s }
+        if field
+          field["value"] = value.to_s
+        else
+          payload["fields"] << {"type" => "CONCEALED", "label" => key.to_s, "value" => value.to_s}
         end
+      end
+      args = if exists
+        [@cli_path, "item", "edit", item, "--vault", vault]
       else
-        args = [@cli_path, "item", "create", "--title", item, "--vault", vault]
-        fields.each do |k, v|
-          args += ["--set", "#{k}=#{v}"]
-        end
-        capture(args)
+        [@cli_path, "item", "create", "--title", item, "--vault", vault, "-"]
       end
+      capture(args, stdin_data: JSON.generate(payload))
     end
 
     private
@@ -70,10 +85,10 @@ module Opdotenv
       raise ArgumentError, "Invalid path format: #{path.inspect}. Must start with 'op://'"
     end
 
-    def capture(args)
+    def capture(args, **options)
       # Use exec-style array to prevent shell injection
       # Open3.capture2e captures both stdout and stderr, and properly returns exit status
-      out, status = Open3.capture2e(*args)
+      out, status = Open3.capture2e(*args, **options)
 
       # For JSON output, try to parse even if exit code is non-zero
       # Some op commands may return non-zero but still output valid JSON

data/lib/opdotenv/version.rb

@@ -1,3 +1,3 @@
 module Opdotenv
-  VERSION = "1.0.5"
+  VERSION = "1.0.6"
 end

data/lib/opdotenv.rb

@@ -1,6 +1,5 @@
 require "json"
 require "yaml"
-require "shellwords"
 
 require_relative "opdotenv/version"
 require_relative "opdotenv/format_inferrer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: opdotenv
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.0.6
 platform: ruby
 authors:
 - Andrei Makarov
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -61,58 +61,16 @@ dependencies:
   name: polyrun
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.5.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.5.0
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: simplecov-cobertura
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3'
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3'
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -337,14 +295,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Load and export environment variables with 1Password CLI or Connect API
 test_files: []