openclaw-plugin-onepassword 0.1.0

package/dist/index.js

@@ -0,0 +1,180 @@
+/**
+ * openclaw-plugin-onepassword
+ *
+ * Native OpenClaw plugin that resolves 1Password secrets *in-process* (inside
+ * the Gateway, not as a sandboxed child) and writes them into OpenClaw's shared
+ * secret store, plus optional agent tools for vault/item operations.
+ *
+ * Why in-process: OpenClaw v2026.8.1 sandboxes exec secret providers, blocking
+ * filesystem writes and network access — which breaks `op read` and any other
+ * network-dependent exec resolver. Running inside the Gateway process avoids the
+ * sandbox entirely, so the official `@1password/sdk` can reach the 1Password API
+ * over HTTPS normally.
+ */
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import { parsePluginConfig, readServiceAccountToken, } from "./config.js";
+import { createOnePasswordClient } from "./op-client.js";
+import { syncSecrets, syncResultIsClean, } from "./secret-sync.js";
+import { createTools } from "./tools.js";
+import { PLUGIN_ID, PLUGIN_VERSION } from "./version.js";
+const SERVICE_ID = "onepassword-secret-sync";
+const STORE_SET_METHOD = "secrets.store.set";
+/**
+ * StoreWriter backed by the `secrets.store.set` Gateway RPC dispatched through
+ * the trusted plugin runtime. Retries briefly while the Gateway request context
+ * is still coming up during cold start.
+ */
+function createStoreWriter(api) {
+    return {
+        async write(name, value) {
+            const gateway = api.runtime?.gateway;
+            if (!gateway) {
+                throw new Error("plugin runtime gateway is unavailable; cannot write to the secret store");
+            }
+            const deadline = Date.now() + 10_000;
+            let lastError;
+            // The gateway request context may not be ready the instant a startup
+            // service runs; retry with backoff until it is (or we give up).
+            for (let attempt = 0;; attempt++) {
+                try {
+                    if (await gateway.isAvailable()) {
+                        await gateway.request(STORE_SET_METHOD, { name, value });
+                        return;
+                    }
+                    lastError = new Error("gateway request context not yet available");
+                }
+                catch (err) {
+                    lastError = err;
+                }
+                if (Date.now() >= deadline)
+                    break;
+                await delay(Math.min(1000, 100 * 2 ** attempt));
+            }
+            throw lastError instanceof Error ? lastError : new Error(String(lastError));
+        },
+    };
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Lazily create and memoize a 1Password client from the configured token. */
+function createClientFactory(config) {
+    let cached;
+    return () => {
+        if (!cached) {
+            const token = readServiceAccountToken(config);
+            if (!token) {
+                return Promise.reject(new Error(`1Password service account token not found. Set the ${config.serviceAccountTokenEnvVar} environment variable on the Gateway process.`));
+            }
+            cached = createOnePasswordClient({
+                token,
+                integrationName: config.integrationName,
+                integrationVersion: PLUGIN_VERSION,
+                requestTimeoutMs: config.requestTimeoutMs,
+            }).catch((err) => {
+                cached = undefined; // allow retry on next call
+                throw err;
+            });
+        }
+        return cached;
+    };
+}
+export default definePluginEntry({
+    id: PLUGIN_ID,
+    name: "1Password",
+    description: "Resolve 1Password secrets in-process into the OpenClaw store, and expose 1Password vault/item tools to agents.",
+    register(api) {
+        const logger = api.logger;
+        let config;
+        try {
+            config = parsePluginConfig(api.pluginConfig);
+        }
+        catch (err) {
+            // Surface config errors loudly; do not register anything with bad config.
+            logger?.error?.(`onepassword: invalid plugin config: ${err instanceof Error ? err.message : String(err)}`);
+            throw err;
+        }
+        const getClient = createClientFactory(config);
+        const store = createStoreWriter(api);
+        const runSync = async () => {
+            const client = await getClient();
+            return syncSecrets({ client, store, secrets: config.secrets, logger });
+        };
+        // --- Startup / reload sync service -----------------------------------
+        api.registerService({
+            id: SERVICE_ID,
+            async start() {
+                if (!config.syncOnStartup) {
+                    logger?.debug?.("onepassword: syncOnStartup disabled; skipping startup sync");
+                    return;
+                }
+                if (Object.keys(config.secrets).length === 0) {
+                    logger?.debug?.("onepassword: no secrets configured; nothing to sync at startup");
+                    return;
+                }
+                if (!readServiceAccountToken(config)) {
+                    const message = `onepassword: ${config.serviceAccountTokenEnvVar} is not set; cannot sync secrets at startup`;
+                    if (config.failFastOnStartup)
+                        throw new Error(message);
+                    logger?.warn?.(message);
+                    return;
+                }
+                try {
+                    const result = await runSync();
+                    if (config.failFastOnStartup && !syncResultIsClean(result)) {
+                        throw new Error(`onepassword: startup sync failed for ${result.total - result.written.length} of ${result.total} secret(s)`);
+                    }
+                }
+                catch (err) {
+                    if (config.failFastOnStartup)
+                        throw err;
+                    logger?.error?.(`onepassword: startup sync error: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            },
+        });
+        // --- Gateway methods --------------------------------------------------
+        // onepassword.sync — re-fetch every configured secret from 1Password and
+        // write it into the store. This is what makes fresh values available at
+        // runtime (analogous to, and composable with, `openclaw secrets reload`).
+        api.registerGatewayMethod("onepassword.sync", async ({ respond }) => {
+            try {
+                const result = await runSync();
+                respond(true, {
+                    written: result.written,
+                    total: result.total,
+                    resolveErrors: result.resolveErrors,
+                    storeErrors: result.storeErrors,
+                });
+            }
+            catch (err) {
+                respond(false, undefined, {
+                    code: "ONEPASSWORD_SYNC_FAILED",
+                    message: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }, { scope: "operator.admin" });
+        // onepassword.status — cheap health/config summary (no secret values).
+        api.registerGatewayMethod("onepassword.status", ({ respond }) => {
+            respond(true, {
+                version: PLUGIN_VERSION,
+                serviceAccountTokenEnvVar: config.serviceAccountTokenEnvVar,
+                tokenPresent: readServiceAccountToken(config) !== undefined,
+                syncOnStartup: config.syncOnStartup,
+                managedStoreKeys: Object.keys(config.secrets),
+                toolsEnabled: config.tools.enabled,
+                toolsWriteEnabled: config.tools.allowWrite,
+            });
+        }, { scope: "operator.admin" });
+        // --- Agent tools (optional) ------------------------------------------
+        if (config.tools.enabled) {
+            const tools = createTools({ getClient, allowWrite: config.tools.allowWrite });
+            for (const tool of tools) {
+                // Boundary cast: PluginTool is a structural subset of the SDK's tool type.
+                api.registerTool(tool, { optional: true });
+            }
+            logger?.debug?.(`onepassword: registered ${tools.length} agent tool(s) (write=${config.tools.allowWrite})`);
+        }
+        logger?.info?.(`onepassword plugin v${PLUGIN_VERSION} registered`);
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAA0B,MAAM,gBAAgB,CAAC;AACjF,OAAO,EACL,WAAW,EACX,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,KAAa;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;YACrC,IAAI,SAAkB,CAAC;YACvB,qEAAqE;YACrE,gEAAgE;YAChE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;wBAChC,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;wBACzD,OAAO;oBACT,CAAC;oBACD,SAAS,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAAE,MAAM;gBAClC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,MAA+B;IAC1D,IAAI,MAA8C,CAAC;IACnD,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,sDAAsD,MAAM,CAAC,yBAAyB,+CAA+C,CACtI,CACF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,uBAAuB,CAAC;gBAC/B,KAAK;gBACL,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,kBAAkB,EAAE,cAAc;gBAClC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,MAAM,GAAG,SAAS,CAAC,CAAC,2BAA2B;gBAC/C,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,iBAAiB,CAAC;IAC/B,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EACT,gHAAgH;IAClH,QAAQ,CAAC,GAAsB;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAgC,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,MAAM,EAAE,KAAK,EAAE,CACb,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,KAAK,IAA6C,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,OAAO,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC;QAEF,wEAAwE;QACxE,GAAG,CAAC,eAAe,CAAC;YAClB,EAAE,EAAE,UAAU;YACd,KAAK,CAAC,KAAK;gBACT,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC1B,MAAM,EAAE,KAAK,EAAE,CAAC,4DAA4D,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7C,MAAM,EAAE,KAAK,EAAE,CAAC,gEAAgE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,gBAAgB,MAAM,CAAC,yBAAyB,6CAA6C,CAAC;oBAC9G,IAAI,MAAM,CAAC,iBAAiB;wBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACvD,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;oBAC/B,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3D,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,OAAO,MAAM,CAAC,KAAK,YAAY,CAC5G,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,MAAM,CAAC,iBAAiB;wBAAE,MAAM,GAAG,CAAC;oBACxC,MAAM,EAAE,KAAK,EAAE,CACb,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,GAAG,CAAC,qBAAqB,CACvB,kBAAkB,EAClB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,EAAE;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;oBACxB,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EACD,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;QAEF,uEAAuE;QACvE,GAAG,CAAC,qBAAqB,CACvB,oBAAoB,EACpB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACd,OAAO,CAAC,IAAI,EAAE;gBACZ,OAAO,EAAE,cAAc;gBACvB,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;gBAC3D,YAAY,EAAE,uBAAuB,CAAC,MAAM,CAAC,KAAK,SAAS;gBAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC7C,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAClC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aAC3C,CAAC,CAAC;QACL,CAAC,EACD,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;QAEF,wEAAwE;QACxE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,2EAA2E;gBAC3E,GAAG,CAAC,YAAY,CAAC,IAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,CACb,2BAA2B,KAAK,CAAC,MAAM,yBAAyB,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,CAAC,uBAAuB,cAAc,aAAa,CAAC,CAAC;IACrE,CAAC;CACF,CAAC,CAAC"}

package/dist/op-client.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Thin, testable wrapper over the official `@1password/sdk`.
+ *
+ * The wrapper exists so the rest of the plugin depends on a small, stable
+ * interface ({@link OnePasswordClient}) rather than the SDK surface directly,
+ * which keeps unit tests fast (no network, no real SDK) and isolates us from
+ * SDK churn.
+ */
+import type { Item, ItemCreateParams, ItemOverview, VaultOverview } from "@1password/sdk";
+export interface ResolveResult {
+    /** Resolved values keyed by the original reference. */
+    values: Record<string, string>;
+    /** References that failed, keyed by reference -> error message. */
+    errors: Record<string, string>;
+}
+/** The stable surface the rest of the plugin relies on. */
+export interface OnePasswordClient {
+    resolve(reference: string): Promise<string>;
+    resolveAll(references: string[]): Promise<ResolveResult>;
+    listVaults(): Promise<VaultOverview[]>;
+    listItems(vaultId: string): Promise<ItemOverview[]>;
+    getItem(vaultId: string, itemId: string): Promise<Item>;
+    createItem(params: ItemCreateParams): Promise<Item>;
+    updateItem(item: Item): Promise<Item>;
+    deleteItem(vaultId: string, itemId: string): Promise<void>;
+}
+export interface CreateClientOptions {
+    token: string;
+    integrationName: string;
+    integrationVersion?: string;
+    /** Per-operation timeout in milliseconds. */
+    requestTimeoutMs?: number;
+}
+/**
+ * Create an authenticated {@link OnePasswordClient}. The `@1password/sdk`
+ * package is imported dynamically so it is only loaded when 1Password access is
+ * actually used, keeping gateway startup cheap for operators who install but do
+ * not configure the plugin.
+ */
+export declare function createOnePasswordClient(options: CreateClientOptions): Promise<OnePasswordClient>;
+//# sourceMappingURL=op-client.d.ts.map

package/dist/op-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"op-client.d.ts","sourceRoot":"","sources":["../src/op-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAU,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIlG,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4GD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAW5B"}

package/dist/op-client.js

@@ -0,0 +1,122 @@
+/**
+ * Thin, testable wrapper over the official `@1password/sdk`.
+ *
+ * The wrapper exists so the rest of the plugin depends on a small, stable
+ * interface ({@link OnePasswordClient}) rather than the SDK surface directly,
+ * which keeps unit tests fast (no network, no real SDK) and isolates us from
+ * SDK churn.
+ */
+import { PLUGIN_VERSION } from "./version.js";
+/** Reject a promise that does not settle within `ms`. */
+async function withTimeout(promise, ms, label) {
+    if (!ms || ms <= 0)
+        return promise;
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            reject(new Error(`1Password operation "${label}" timed out after ${ms}ms`));
+        }, ms);
+        // Do not keep the event loop alive solely for this timer.
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function resolveAllUnsupported(err) {
+    // Older SDKs may not implement resolveAll; fall back to per-ref resolve.
+    return (err instanceof TypeError ||
+        (err instanceof Error && /resolveAll is not a function/i.test(err.message)));
+}
+class SdkOnePasswordClient {
+    client;
+    timeoutMs;
+    constructor(client, timeoutMs) {
+        this.client = client;
+        this.timeoutMs = timeoutMs;
+    }
+    resolve(reference) {
+        return withTimeout(this.client.secrets.resolve(reference), this.timeoutMs, "secrets.resolve");
+    }
+    async resolveAll(references) {
+        const values = {};
+        const errors = {};
+        if (references.length === 0)
+            return { values, errors };
+        // Prefer the batched SDK call when available.
+        try {
+            const response = await withTimeout(this.client.secrets.resolveAll(references), this.timeoutMs, "secrets.resolveAll");
+            for (const [reference, entry] of Object.entries(response.individualResponses ?? {})) {
+                if (entry?.content?.secret !== undefined) {
+                    values[reference] = entry.content.secret;
+                }
+                else if (entry?.error) {
+                    errors[reference] = entry.error.message ?? String(entry.error.type ?? "unknown error");
+                }
+            }
+            // Any reference the batch response omitted is treated as an error below.
+            for (const reference of references) {
+                if (!(reference in values) && !(reference in errors)) {
+                    errors[reference] = "1Password returned no response for this reference";
+                }
+            }
+            return { values, errors };
+        }
+        catch (err) {
+            if (!resolveAllUnsupported(err)) {
+                // Batch call failed wholesale (e.g. auth/timeout). Fall through to
+                // per-reference resolution so a single bad ref does not sink the rest.
+            }
+        }
+        await Promise.all(references.map(async (reference) => {
+            try {
+                values[reference] = await this.resolve(reference);
+            }
+            catch (err) {
+                errors[reference] = err instanceof Error ? err.message : String(err);
+            }
+        }));
+        return { values, errors };
+    }
+    listVaults() {
+        return withTimeout(this.client.vaults.list(), this.timeoutMs, "vaults.list");
+    }
+    listItems(vaultId) {
+        return withTimeout(this.client.items.list(vaultId), this.timeoutMs, "items.list");
+    }
+    getItem(vaultId, itemId) {
+        return withTimeout(this.client.items.get(vaultId, itemId), this.timeoutMs, "items.get");
+    }
+    createItem(params) {
+        return withTimeout(this.client.items.create(params), this.timeoutMs, "items.create");
+    }
+    updateItem(item) {
+        return withTimeout(this.client.items.put(item), this.timeoutMs, "items.put");
+    }
+    deleteItem(vaultId, itemId) {
+        return withTimeout(this.client.items.delete(vaultId, itemId), this.timeoutMs, "items.delete");
+    }
+}
+/**
+ * Create an authenticated {@link OnePasswordClient}. The `@1password/sdk`
+ * package is imported dynamically so it is only loaded when 1Password access is
+ * actually used, keeping gateway startup cheap for operators who install but do
+ * not configure the plugin.
+ */
+export async function createOnePasswordClient(options) {
+    if (!options.token || options.token.trim().length === 0) {
+        throw new Error("A 1Password service account token is required to create a client.");
+    }
+    const { createClient } = await import("@1password/sdk");
+    const client = await createClient({
+        auth: options.token,
+        integrationName: options.integrationName,
+        integrationVersion: options.integrationVersion ?? PLUGIN_VERSION,
+    });
+    return new SdkOnePasswordClient(client, options.requestTimeoutMs ?? 0);
+}
+//# sourceMappingURL=op-client.js.map

package/dist/op-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"op-client.js","sourceRoot":"","sources":["../src/op-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA6B9C,yDAAyD;AACzD,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IAC1E,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,KAAK,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,0DAA0D;QAC1D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,yEAAyE;IACzE,OAAO,CACL,GAAG,YAAY,SAAS;QACxB,CAAC,GAAG,YAAY,KAAK,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB;IAEL;IACA;IAFnB,YACmB,MAAc,EACd,SAAiB;QADjB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,OAAO,CAAC,SAAiB;QACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAoB;QACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAEvD,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAC1C,IAAI,CAAC,SAAS,EACd,oBAAoB,CACrB,CAAC;YACF,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpF,IAAI,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC3C,CAAC;qBAAM,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACxB,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,yEAAyE;YACzE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;oBACrD,MAAM,CAAC,SAAS,CAAC,GAAG,mDAAmD,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,mEAAmE;gBACnE,uEAAuE;YACzE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,UAAU;QACR,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/E,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,CAAC,OAAe,EAAE,MAAc;QACrC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED,UAAU,CAAC,MAAwB;QACjC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACvF,CAAC;IAED,UAAU,CAAC,IAAU;QACnB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/E,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,MAAc;QACxC,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAChG,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,KAAK;QACnB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,cAAc;KACjE,CAAC,CAAC;IACH,OAAO,IAAI,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/resolver.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Standalone exec secret resolver (OPTIONAL / ADVANCED).
+ *
+ * OpenClaw's `secretProviderIntegrations` feature runs this file as
+ * `node dist/resolver.js` (a child process) and speaks a small JSON protocol
+ * over stdin/stdout:
+ *
+ *   request:  { "protocolVersion": 1, "provider": "op", "ids": ["op://Vault/Item/field"] }
+ *   response: { "protocolVersion": 1, "values": { "op://Vault/Item/field": "<secret>" } }
+ *
+ * IMPORTANT: because this runs as an *exec* secret provider, it is subject to
+ * the v2026.8.1 exec sandbox that blocks filesystem writes and network access.
+ * It therefore only works when the operator has allowlisted the 1Password API
+ * host for secret egress (see README → "Exec resolver mode"). For most setups,
+ * prefer the in-process store sync, which is not sandboxed.
+ *
+ * This module intentionally imports nothing from `openclaw` so it stays a
+ * lightweight, independently testable leaf.
+ */
+interface ResolverRequest {
+    protocolVersion?: number;
+    provider?: string;
+    ids?: string[];
+}
+interface ResolverResponse {
+    protocolVersion: 1;
+    values: Record<string, string>;
+    errors?: Record<string, {
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function resolveRequest(request: ResolverRequest, env?: NodeJS.ProcessEnv): Promise<ResolverResponse>;
+/** CLI entrypoint: read a request from stdin, print a response to stdout. */
+export declare function main(): Promise<void>;
+export {};
+//# sourceMappingURL=resolver.d.ts.map

package/dist/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,UAAU,eAAe;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,UAAU,gBAAgB;IACxB,eAAe,EAAE,CAAC,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AA2BD,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAmC3B;AAED,6EAA6E;AAC7E,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1C"}

package/dist/resolver.js

@@ -0,0 +1,98 @@
+/**
+ * Standalone exec secret resolver (OPTIONAL / ADVANCED).
+ *
+ * OpenClaw's `secretProviderIntegrations` feature runs this file as
+ * `node dist/resolver.js` (a child process) and speaks a small JSON protocol
+ * over stdin/stdout:
+ *
+ *   request:  { "protocolVersion": 1, "provider": "op", "ids": ["op://Vault/Item/field"] }
+ *   response: { "protocolVersion": 1, "values": { "op://Vault/Item/field": "<secret>" } }
+ *
+ * IMPORTANT: because this runs as an *exec* secret provider, it is subject to
+ * the v2026.8.1 exec sandbox that blocks filesystem writes and network access.
+ * It therefore only works when the operator has allowlisted the 1Password API
+ * host for secret egress (see README → "Exec resolver mode"). For most setups,
+ * prefer the in-process store sync, which is not sandboxed.
+ *
+ * This module intentionally imports nothing from `openclaw` so it stays a
+ * lightweight, independently testable leaf.
+ */
+import { createOnePasswordClient } from "./op-client.js";
+import { DEFAULT_INTEGRATION_NAME, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_TOKEN_ENV_VAR, } from "./config.js";
+const NOT_FOUND = "NOT_FOUND";
+const UNAVAILABLE = "UNAVAILABLE";
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", reject);
+    });
+}
+function parseRequest(input) {
+    const trimmed = input.trim();
+    if (trimmed.length === 0)
+        return {};
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error("resolver request must be a JSON object");
+    }
+    return parsed;
+}
+export async function resolveRequest(request, env = process.env) {
+    const ids = Array.isArray(request.ids) ? request.ids.filter((id) => typeof id === "string") : [];
+    const response = { protocolVersion: 1, values: {} };
+    if (ids.length === 0)
+        return response;
+    const tokenEnvVar = env.OP_RESOLVER_TOKEN_ENV_VAR?.trim() || DEFAULT_TOKEN_ENV_VAR;
+    const token = env[tokenEnvVar]?.trim();
+    if (!token) {
+        response.errors = {};
+        for (const id of ids) {
+            response.errors[id] = {
+                code: UNAVAILABLE,
+                message: `service account token env var ${tokenEnvVar} is not set`,
+            };
+        }
+        return response;
+    }
+    const client = await createOnePasswordClient({
+        token,
+        integrationName: env.OP_INTEGRATION_NAME?.trim() || DEFAULT_INTEGRATION_NAME,
+        requestTimeoutMs: DEFAULT_REQUEST_TIMEOUT_MS,
+    });
+    const { values, errors } = await client.resolveAll(ids);
+    response.values = values;
+    const errorEntries = Object.entries(errors);
+    if (errorEntries.length > 0) {
+        response.errors = {};
+        for (const [id, message] of errorEntries) {
+            const code = /not\s*found|no item|no vault/i.test(message) ? NOT_FOUND : UNAVAILABLE;
+            response.errors[id] = { code, message };
+        }
+    }
+    return response;
+}
+/** CLI entrypoint: read a request from stdin, print a response to stdout. */
+export async function main() {
+    try {
+        const request = parseRequest(await readStdin());
+        const response = await resolveRequest(request);
+        process.stdout.write(JSON.stringify(response));
+    }
+    catch (err) {
+        // Never leak error internals to stdout (may contain credential material).
+        process.stderr.write(`onepassword resolver error: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.stdout.write(JSON.stringify({ protocolVersion: 1, values: {} }));
+        process.exitCode = 1;
+    }
+}
+// Run only when executed directly (node dist/resolver.js), not when imported by tests.
+const invokedPath = process.argv[1] ? process.argv[1].replace(/\\/g, "/") : "";
+if (invokedPath.endsWith("/resolver.js") || invokedPath.endsWith("/resolver.ts")) {
+    void main();
+}
+//# sourceMappingURL=resolver.js.map

package/dist/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAcrB,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAqB,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtC,MAAM,WAAW,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,qBAAqB,CAAC;IACnF,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;gBACpB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,iCAAiC,WAAW,aAAa;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,KAAK;QACL,eAAe,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,wBAAwB;QAC5E,gBAAgB,EAAE,0BAA0B;KAC7C,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;YACrF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACpF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;IACjF,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/dist/secret-sync.d.ts

@@ -0,0 +1,54 @@
+/**
+ * In-process secret synchronization.
+ *
+ * This is the mechanism that bypasses the OpenClaw exec secret sandbox: instead
+ * of running `op` (or any resolver) as a sandboxed child process, the plugin
+ * runs inside the Gateway process, fetches values from 1Password over HTTPS
+ * using the official SDK, and writes them into OpenClaw's shared secret store.
+ * Operators then reference those values with `source: "store"`.
+ */
+import type { OnePasswordClient } from "./op-client.js";
+/** Minimal logger surface (compatible with OpenClaw's PluginLogger). */
+export interface SyncLogger {
+    info?: (message: string) => void;
+    warn?: (message: string) => void;
+    error?: (message: string) => void;
+    debug?: (message: string) => void;
+}
+/**
+ * Writes a resolved secret into OpenClaw's shared store.
+ *
+ * Implemented in {@link file://./index.ts} by dispatching the
+ * `secrets.store.set` Gateway method through `api.runtime.gateway.request`,
+ * which persists the value (team scope) and triggers a live runtime refresh so
+ * dependent channels/providers pick it up without a restart.
+ */
+export interface StoreWriter {
+    write(name: string, value: string): Promise<void>;
+}
+export interface SyncOptions {
+    client: OnePasswordClient;
+    store: StoreWriter;
+    /** Map of store key -> op:// reference. */
+    secrets: Record<string, string>;
+    logger?: SyncLogger;
+}
+export interface SyncResult {
+    /** Store keys successfully fetched and written. */
+    written: string[];
+    /** Store key -> error message for references that failed to resolve. */
+    resolveErrors: Record<string, string>;
+    /** Store key -> error message for values that resolved but failed to store. */
+    storeErrors: Record<string, string>;
+    /** Total number of configured references. */
+    total: number;
+}
+export declare function syncResultIsClean(result: SyncResult): boolean;
+/**
+ * Resolve every configured reference from 1Password and write it into the
+ * store. Individual failures are collected rather than thrown so one bad
+ * reference cannot prevent the rest of the secrets from loading. The caller
+ * decides whether a partial failure is fatal (see `failFastOnStartup`).
+ */
+export declare function syncSecrets(options: SyncOptions): Promise<SyncResult>;
+//# sourceMappingURL=secret-sync.d.ts.map

package/dist/secret-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sync.d.ts","sourceRoot":"","sources":["../src/secret-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,EAAE,WAAW,CAAC;IACnB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAI7D;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAgD3E"}

package/dist/secret-sync.js

@@ -0,0 +1,64 @@
+/**
+ * In-process secret synchronization.
+ *
+ * This is the mechanism that bypasses the OpenClaw exec secret sandbox: instead
+ * of running `op` (or any resolver) as a sandboxed child process, the plugin
+ * runs inside the Gateway process, fetches values from 1Password over HTTPS
+ * using the official SDK, and writes them into OpenClaw's shared secret store.
+ * Operators then reference those values with `source: "store"`.
+ */
+export function syncResultIsClean(result) {
+    return (Object.keys(result.resolveErrors).length === 0 && Object.keys(result.storeErrors).length === 0);
+}
+/**
+ * Resolve every configured reference from 1Password and write it into the
+ * store. Individual failures are collected rather than thrown so one bad
+ * reference cannot prevent the rest of the secrets from loading. The caller
+ * decides whether a partial failure is fatal (see `failFastOnStartup`).
+ */
+export async function syncSecrets(options) {
+    const { client, store, secrets, logger } = options;
+    const entries = Object.entries(secrets);
+    const result = {
+        written: [],
+        resolveErrors: {},
+        storeErrors: {},
+        total: entries.length,
+    };
+    if (entries.length === 0) {
+        logger?.debug?.("onepassword: no secrets configured to sync");
+        return result;
+    }
+    // Resolve references in a single batch. Map references back to store keys;
+    // note two store keys may point at the same reference.
+    const references = [...new Set(entries.map(([, ref]) => ref))];
+    const { values, errors } = await client.resolveAll(references);
+    for (const [key, reference] of entries) {
+        const value = values[reference];
+        if (value === undefined) {
+            const message = errors[reference] ?? "reference did not resolve";
+            result.resolveErrors[key] = message;
+            logger?.warn?.(`onepassword: failed to resolve ${key} (${reference}): ${message}`);
+            continue;
+        }
+        try {
+            await store.write(key, value);
+            result.written.push(key);
+            logger?.debug?.(`onepassword: stored ${key} from ${reference}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            result.storeErrors[key] = message;
+            logger?.error?.(`onepassword: failed to store ${key}: ${message}`);
+        }
+    }
+    const failed = Object.keys(result.resolveErrors).length + Object.keys(result.storeErrors).length;
+    if (failed === 0) {
+        logger?.info?.(`onepassword: synced ${result.written.length} secret(s) into the store`);
+    }
+    else {
+        logger?.warn?.(`onepassword: synced ${result.written.length}/${result.total} secret(s); ${failed} failed`);
+    }
+    return result;
+}
+//# sourceMappingURL=secret-sync.js.map

package/dist/secret-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-sync.js","sourceRoot":"","sources":["../src/secret-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2CH,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE/D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,2BAA2B,CAAC;YACjE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACpC,MAAM,EAAE,IAAI,EAAE,CAAC,kCAAkC,GAAG,KAAK,SAAS,MAAM,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,EAAE,KAAK,EAAE,CAAC,uBAAuB,GAAG,SAAS,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,CAAC,gCAAgC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IACjG,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,CAAC,uBAAuB,MAAM,CAAC,OAAO,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,IAAI,EAAE,CACZ,uBAAuB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,eAAe,MAAM,SAAS,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}