openclaw-plugin-onepassword 0.1.0

package/dist/tools.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Optional agent tools for 1Password vault/item operations.
+ *
+ * These run in-process (no exec sandbox) and are only registered when the
+ * operator sets `tools.enabled` (and `tools.allowWrite` for mutating tools).
+ * Read tools redact concealed field values by default so secrets are not
+ * casually surfaced into model context.
+ */
+import { type TSchema } from "typebox";
+import type { OnePasswordClient } from "./op-client.js";
+/** Structural mirror of OpenClaw's AgentTool, kept local to avoid a hard SDK type import. */
+export interface PluginTool {
+    name: string;
+    description: string;
+    label: string;
+    parameters: TSchema;
+    outputSchema?: TSchema;
+    execute: (toolCallId: string, params: unknown) => Promise<{
+        content: Array<{
+            type: "text";
+            text: string;
+        }>;
+        details: unknown;
+    }>;
+}
+export type ClientFactory = () => Promise<OnePasswordClient>;
+export interface CreateToolsOptions {
+    getClient: ClientFactory;
+    allowWrite: boolean;
+}
+export declare function createTools(options: CreateToolsOptions): PluginTool[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAqB,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,6FAA6F;AAC7F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;CACrB;AA+FD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,EAAE,CA+LrE"}

package/dist/tools.js

@@ -0,0 +1,261 @@
+/**
+ * Optional agent tools for 1Password vault/item operations.
+ *
+ * These run in-process (no exec sandbox) and are only registered when the
+ * operator sets `tools.enabled` (and `tools.allowWrite` for mutating tools).
+ * Read tools redact concealed field values by default so secrets are not
+ * casually surfaced into model context.
+ */
+import { Type } from "typebox";
+/** 1Password item categories accepted by the create/update tools. */
+const ITEM_CATEGORIES = [
+    "Login",
+    "SecureNote",
+    "CreditCard",
+    "CryptoWallet",
+    "Identity",
+    "Password",
+    "Document",
+    "ApiCredentials",
+    "BankAccount",
+    "Database",
+    "DriverLicense",
+    "Email",
+    "MedicalRecord",
+    "Membership",
+    "OutdoorLicense",
+    "Passport",
+    "Rewards",
+    "Router",
+    "Server",
+    "SshKey",
+    "SocialSecurityNumber",
+    "SoftwareLicense",
+    "Person",
+];
+const FIELD_TYPES = [
+    "Text",
+    "Concealed",
+    "CreditCardType",
+    "CreditCardNumber",
+    "Phone",
+    "Url",
+    "Totp",
+    "Email",
+    "Reference",
+    "Menu",
+    "MonthYear",
+    "Date",
+];
+const CONCEALED_FIELD_TYPES = new Set(["Concealed", "Totp"]);
+const FieldInput = Type.Object({
+    title: Type.String({ description: "Field label, e.g. 'password' or 'api_key'." }),
+    value: Type.String({ description: "Field value." }),
+    fieldType: Type.Optional(Type.Union(FIELD_TYPES.map((t) => Type.Literal(t)), { description: "Field type; defaults to 'Text' ('Concealed' for secrets)." })),
+    sectionId: Type.Optional(Type.String()),
+});
+function text(value) {
+    return { content: [{ type: "text", text: value }] };
+}
+function projectFields(fields, includeSecrets) {
+    return fields.map((field) => {
+        const concealed = CONCEALED_FIELD_TYPES.has(field.fieldType);
+        return {
+            id: field.id,
+            title: field.title,
+            fieldType: field.fieldType,
+            sectionId: field.sectionId,
+            value: concealed && !includeSecrets ? "<concealed>" : field.value,
+        };
+    });
+}
+function assertWriteEnabled(allowWrite, tool) {
+    if (!allowWrite) {
+        throw new Error(`Tool "${tool}" is disabled. Set plugins.entries.onepassword.config.tools.allowWrite = true to enable write operations.`);
+    }
+}
+export function createTools(options) {
+    const { getClient, allowWrite } = options;
+    const listVaults = {
+        name: "1password_list_vaults",
+        label: "List 1Password vaults",
+        description: "List all 1Password vaults accessible to the configured service account.",
+        parameters: Type.Object({}),
+        execute: async () => {
+            const client = await getClient();
+            const vaults = await client.listVaults();
+            const summary = vaults.map((v) => ({ id: v.id, title: v.title }));
+            return { ...text(JSON.stringify(summary, null, 2)), details: { vaults: summary } };
+        },
+    };
+    const ListItemsParams = Type.Object({
+        vaultId: Type.String({ description: "Vault ID (from 1password_list_vaults)." }),
+    });
+    const listItems = {
+        name: "1password_list_items",
+        label: "List 1Password items",
+        description: "List items in a 1Password vault. Returns overviews only (no field values).",
+        parameters: ListItemsParams,
+        execute: async (_id, raw) => {
+            const params = raw;
+            const client = await getClient();
+            const items = await client.listItems(params.vaultId);
+            const summary = items.map((i) => ({
+                id: i.id,
+                title: i.title,
+                category: i.category,
+                state: i.state,
+            }));
+            return { ...text(JSON.stringify(summary, null, 2)), details: { items: summary } };
+        },
+    };
+    const GetItemParams = Type.Object({
+        vaultId: Type.String(),
+        itemId: Type.String(),
+        includeSecrets: Type.Optional(Type.Boolean({
+            description: "Return concealed field values in plaintext. Defaults to false.",
+        })),
+    });
+    const getItem = {
+        name: "1password_get_item",
+        label: "Get 1Password item",
+        description: "Get a full 1Password item including its fields. Concealed values are redacted unless includeSecrets is true.",
+        parameters: GetItemParams,
+        execute: async (_id, raw) => {
+            const params = raw;
+            const client = await getClient();
+            const item = await client.getItem(params.vaultId, params.itemId);
+            const projected = {
+                id: item.id,
+                title: item.title,
+                category: item.category,
+                vaultId: item.vaultId,
+                tags: item.tags,
+                notes: item.notes,
+                fields: projectFields(item.fields, params.includeSecrets === true),
+            };
+            return { ...text(JSON.stringify(projected, null, 2)), details: projected };
+        },
+    };
+    const ReadFieldParams = Type.Object({
+        reference: Type.String({
+            description: "1Password secret reference, e.g. op://Vault/Item/field.",
+            pattern: "^op://",
+        }),
+    });
+    const readField = {
+        name: "1password_read_field",
+        label: "Read 1Password field",
+        description: "Resolve a single op:// secret reference to its value. Returns the secret in plaintext — use deliberately.",
+        parameters: ReadFieldParams,
+        execute: async (_id, raw) => {
+            const params = raw;
+            const client = await getClient();
+            const value = await client.resolve(params.reference);
+            return { ...text(value), details: { reference: params.reference, resolved: true } };
+        },
+    };
+    const tools = [listVaults, listItems, getItem, readField];
+    if (!allowWrite)
+        return tools;
+    const CreateItemParams = Type.Object({
+        vaultId: Type.String(),
+        title: Type.String(),
+        category: Type.Union(ITEM_CATEGORIES.map((c) => Type.Literal(c)), { description: "1Password item category." }),
+        fields: Type.Optional(Type.Array(FieldInput)),
+        tags: Type.Optional(Type.Array(Type.String())),
+        notes: Type.Optional(Type.String()),
+    });
+    const createItem = {
+        name: "1password_create_item",
+        label: "Create 1Password item",
+        description: "Create a new item in a 1Password vault.",
+        parameters: CreateItemParams,
+        execute: async (_id, raw) => {
+            assertWriteEnabled(allowWrite, "1password_create_item");
+            const params = raw;
+            const client = await getClient();
+            const created = await client.createItem({
+                vaultId: params.vaultId,
+                title: params.title,
+                // Enum values equal their string names in @1password/sdk.
+                category: params.category,
+                fields: mapFields(params.fields),
+                tags: params.tags,
+                notes: params.notes,
+            });
+            return {
+                ...text(`Created item ${created.id} (${created.title}).`),
+                details: { id: created.id, title: created.title, vaultId: created.vaultId },
+            };
+        },
+    };
+    const UpdateItemParams = Type.Object({
+        vaultId: Type.String(),
+        itemId: Type.String(),
+        title: Type.Optional(Type.String()),
+        fields: Type.Optional(Type.Array(FieldInput, {
+            description: "Replacement field set. When provided, replaces the item's fields.",
+        })),
+        tags: Type.Optional(Type.Array(Type.String())),
+        notes: Type.Optional(Type.String()),
+    });
+    const updateItem = {
+        name: "1password_update_item",
+        label: "Update 1Password item",
+        description: "Update an existing 1Password item. Fetches the current item, applies the provided changes, and saves it.",
+        parameters: UpdateItemParams,
+        execute: async (_id, raw) => {
+            assertWriteEnabled(allowWrite, "1password_update_item");
+            const params = raw;
+            const client = await getClient();
+            const current = await client.getItem(params.vaultId, params.itemId);
+            const next = {
+                ...current,
+                ...(params.title !== undefined ? { title: params.title } : {}),
+                ...(params.tags !== undefined ? { tags: params.tags } : {}),
+                ...(params.notes !== undefined ? { notes: params.notes } : {}),
+                ...(params.fields !== undefined ? { fields: mapFields(params.fields) } : {}),
+            };
+            const saved = await client.updateItem(next);
+            return {
+                ...text(`Updated item ${saved.id} (${saved.title}).`),
+                details: { id: saved.id, title: saved.title, version: saved.version },
+            };
+        },
+    };
+    const DeleteItemParams = Type.Object({
+        vaultId: Type.String(),
+        itemId: Type.String(),
+    });
+    const deleteItem = {
+        name: "1password_delete_item",
+        label: "Delete 1Password item",
+        description: "Permanently delete a 1Password item.",
+        parameters: DeleteItemParams,
+        execute: async (_id, raw) => {
+            assertWriteEnabled(allowWrite, "1password_delete_item");
+            const params = raw;
+            const client = await getClient();
+            await client.deleteItem(params.vaultId, params.itemId);
+            return {
+                ...text(`Deleted item ${params.itemId} from vault ${params.vaultId}.`),
+                details: { itemId: params.itemId, vaultId: params.vaultId, deleted: true },
+            };
+        },
+    };
+    tools.push(createItem, updateItem, deleteItem);
+    return tools;
+}
+function mapFields(fields) {
+    if (!fields)
+        return undefined;
+    return fields.map((f) => ({
+        id: f.title.toLowerCase().replace(/\s+/g, "_"),
+        title: f.title,
+        value: f.value,
+        fieldType: f.fieldType ?? "Text",
+        ...(f.sectionId ? { sectionId: f.sectionId } : {}),
+    }));
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAA6B,MAAM,SAAS,CAAC;AAwB1D,qEAAqE;AACrE,MAAM,eAAe,GAAG;IACtB,OAAO;IACP,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,eAAe;IACf,OAAO;IACP,eAAe;IACf,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,sBAAsB;IACtB,iBAAiB;IACjB,QAAQ;CACA,CAAC;AAEX,MAAM,WAAW,GAAG;IAClB,MAAM;IACN,WAAW;IACX,gBAAgB;IAChB,kBAAkB;IAClB,OAAO;IACP,KAAK;IACL,MAAM;IACN,OAAO;IACP,WAAW;IACX,MAAM;IACN,WAAW;IACX,MAAM;CACE,CAAC;AAEX,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IACjF,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACnD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACR,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EACvC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAC7E,CACF;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC;AAGH,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAUD,SAAS,aAAa,CACpB,MAAsC,EACtC,cAAuB;IAEvB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,SAAS,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAmB,EAAE,IAAY;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,2GAA2G,CACzH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA2B;IACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAE1C,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,yEAAyE;QACtF,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACrF,CAAC;KACF,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,SAAS,GAAe;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,4EAA4E;QACzF,UAAU,EAAE,eAAe;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,GAAqC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACpF,CAAC;KACF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACrB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,OAAO,CAAC;YACX,WAAW,EAAE,gEAAgE;SAC9E,CAAC,CACH;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAe;QAC1B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,8GAA8G;QAChH,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,GAAmC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG;gBAChB,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC;aACnE,CAAC;YACF,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7E,CAAC;KACF,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,yDAAyD;YACtE,OAAO,EAAE,QAAQ;SAClB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,SAAS,GAAe;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,2GAA2G;QAC7G,UAAU,EAAE,eAAe;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,GAAqC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACtF,CAAC;KACF,CAAC;IAEF,MAAM,KAAK,GAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAExE,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;QACpB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAClB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAC3C,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAC5C;QACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,yCAAyC;QACtD,UAAU,EAAE,gBAAgB;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,kBAAkB,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAsC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,0DAA0D;gBAC1D,QAAQ,EAAE,MAAM,CAAC,QAAiB;gBAClC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;aACX,CAAC,CAAC;YACZ,OAAO;gBACL,GAAG,IAAI,CAAC,gBAAgB,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;aAC5E,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;YACrB,WAAW,EAAE,mEAAmE;SACjF,CAAC,CACH;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,0GAA0G;QAC5G,UAAU,EAAE,gBAAgB;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,kBAAkB,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAsC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG;gBACX,GAAG,OAAO;gBACV,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAa,CAAC,CAAC;YACrD,OAAO;gBACL,GAAG,IAAI,CAAC,gBAAgB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC;gBACrD,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;aACtE,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IACH,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,sCAAsC;QACnD,UAAU,EAAE,gBAAgB;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1B,kBAAkB,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAsC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO;gBACL,GAAG,IAAI,CAAC,gBAAgB,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,GAAG,CAAC;gBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;aAC3E,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,MAAgC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QAC9C,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,MAAM;QAChC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Plugin version, reported to the 1Password SDK as the integration version and
+ * surfaced by the `onepassword.status` gateway method.
+ *
+ * Kept in sync with package.json by the `version-matches-package` unit test.
+ */
+export declare const PLUGIN_VERSION = "0.1.0";
+export declare const PLUGIN_ID = "onepassword";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,eAAO,MAAM,SAAS,gBAAgB,CAAC"}

package/dist/version.js

@@ -0,0 +1,9 @@
+/**
+ * Plugin version, reported to the 1Password SDK as the integration version and
+ * surfaced by the `onepassword.status` gateway method.
+ *
+ * Kept in sync with package.json by the `version-matches-package` unit test.
+ */
+export const PLUGIN_VERSION = "0.1.0";
+export const PLUGIN_ID = "onepassword";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC"}

package/examples/openclaw.exec-mode.json

@@ -0,0 +1,58 @@
+{
+  "$comment": "ADVANCED. Exec resolver via pluginIntegration, using op:// ids directly on SecretRefs. Runs as a sandboxed child process, so you MUST allowlist the 1Password API host under secrets.egressProxy for it to reach the network. Prefer store mode unless you specifically need op:// ids and native `openclaw secrets reload` re-fetching.",
+  "plugins": {
+    "entries": {
+      "onepassword": {
+        "enabled": true,
+        "config": {
+          "serviceAccountTokenEnvVar": "OP_SERVICE_ACCOUNT_TOKEN"
+        }
+      }
+    }
+  },
+  "secrets": {
+    "providers": {
+      "op": {
+        "source": "exec",
+        "pluginIntegration": { "pluginId": "onepassword", "integrationId": "op" }
+      }
+    },
+    "egressProxy": {
+      "enabled": true,
+      "allowedHosts": ["my.1password.com"]
+    }
+  },
+  "channels": {
+    "slack": {
+      "accounts": {
+        "myworkspace": {
+          "botToken": {
+            "source": "exec",
+            "provider": "op",
+            "id": "op://MyVault/SlackBot/bot_token"
+          },
+          "appToken": {
+            "source": "exec",
+            "provider": "op",
+            "id": "op://MyVault/SlackBot/app_token"
+          }
+        }
+      }
+    }
+  },
+  "agents": {
+    "defaults": {
+      "model": {
+        "providers": {
+          "openai": {
+            "apiKey": {
+              "source": "exec",
+              "provider": "op",
+              "id": "op://MyVault/OpenAI/credential"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/examples/openclaw.store-mode.json

@@ -0,0 +1,40 @@
+{
+  "$comment": "RECOMMENDED. In-process store sync. The plugin fetches op:// references from 1Password at startup and writes them into OpenClaw's shared store; SecretRefs use source:'store'. No secret values live in this file. Set OP_SERVICE_ACCOUNT_TOKEN on the Gateway process.",
+  "plugins": {
+    "entries": {
+      "onepassword": {
+        "enabled": true,
+        "config": {
+          "serviceAccountTokenEnvVar": "OP_SERVICE_ACCOUNT_TOKEN",
+          "syncOnStartup": true,
+          "secrets": {
+            "SLACK_BOT_TOKEN": "op://MyVault/SlackBot/bot_token",
+            "SLACK_APP_TOKEN": "op://MyVault/SlackBot/app_token",
+            "OPENAI_API_KEY": "op://MyVault/OpenAI/credential"
+          }
+        }
+      }
+    }
+  },
+  "channels": {
+    "slack": {
+      "accounts": {
+        "myworkspace": {
+          "botToken": { "source": "store", "id": "SLACK_BOT_TOKEN" },
+          "appToken": { "source": "store", "id": "SLACK_APP_TOKEN" }
+        }
+      }
+    }
+  },
+  "agents": {
+    "defaults": {
+      "model": {
+        "providers": {
+          "openai": {
+            "apiKey": { "source": "store", "id": "OPENAI_API_KEY" }
+          }
+        }
+      }
+    }
+  }
+}

package/examples/openclaw.tools-mode.json

@@ -0,0 +1,17 @@
+{
+  "$comment": "Enable the 1Password agent tools so the AI can list vaults/items, read fields, and (opt-in) create/update/delete items. Runs in-process. Set OP_SERVICE_ACCOUNT_TOKEN on the Gateway process.",
+  "plugins": {
+    "entries": {
+      "onepassword": {
+        "enabled": true,
+        "config": {
+          "serviceAccountTokenEnvVar": "OP_SERVICE_ACCOUNT_TOKEN",
+          "tools": {
+            "enabled": true,
+            "allowWrite": false
+          }
+        }
+      }
+    }
+  }
+}

package/openclaw.plugin.json

@@ -0,0 +1,104 @@
+{
+  "id": "onepassword",
+  "name": "1Password",
+  "description": "Resolve 1Password secrets in-process into the OpenClaw shared store, and expose 1Password vault/item tools to agents.",
+  "version": "0.1.0",
+  "activation": {
+    "onStartup": true,
+    "onConfigPaths": ["plugins.entries.onepassword"]
+  },
+  "contracts": {
+    "tools": [
+      "1password_list_vaults",
+      "1password_list_items",
+      "1password_get_item",
+      "1password_read_field",
+      "1password_create_item",
+      "1password_update_item",
+      "1password_delete_item"
+    ],
+    "gatewayMethodDispatch": ["onepassword.sync", "onepassword.status"]
+  },
+  "toolMetadata": {
+    "1password_list_vaults": { "optional": true },
+    "1password_list_items": { "optional": true },
+    "1password_get_item": { "optional": true },
+    "1password_read_field": { "optional": true },
+    "1password_create_item": { "optional": true },
+    "1password_update_item": { "optional": true },
+    "1password_delete_item": { "optional": true }
+  },
+  "secretProviderIntegrations": {
+    "op": {
+      "providerAlias": "op",
+      "displayName": "1Password (exec resolver)",
+      "description": "Advanced/optional. Resolves op:// references via a child node resolver. Subject to the exec secret sandbox — requires egress allowlisting to reach the 1Password API. Prefer the in-process store sync for most setups.",
+      "source": "exec",
+      "command": "${node}",
+      "args": ["./dist/resolver.js"],
+      "jsonOnly": true,
+      "passEnv": ["PATH", "HOME", "OP_SERVICE_ACCOUNT_TOKEN"]
+    }
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "serviceAccountTokenEnvVar": {
+        "type": "string",
+        "description": "Name of the environment variable holding the 1Password service account token.",
+        "default": "OP_SERVICE_ACCOUNT_TOKEN",
+        "minLength": 1
+      },
+      "integrationName": {
+        "type": "string",
+        "description": "Integration name reported to the 1Password SDK for audit logs.",
+        "default": "openclaw-plugin-onepassword"
+      },
+      "requestTimeoutMs": {
+        "type": "number",
+        "description": "Per-operation timeout for 1Password SDK calls, in milliseconds.",
+        "default": 15000,
+        "minimum": 1000
+      },
+      "syncOnStartup": {
+        "type": "boolean",
+        "description": "Fetch the configured `secrets` mapping from 1Password and write it into the OpenClaw store when the gateway starts.",
+        "default": true
+      },
+      "failFastOnStartup": {
+        "type": "boolean",
+        "description": "If true, a startup sync failure throws and prevents the gateway from starting. If false, the plugin logs the error and lets last-known-good store values be used.",
+        "default": false
+      },
+      "secrets": {
+        "type": "object",
+        "description": "Map of OpenClaw store key -> 1Password secret reference (op://Vault/Item[/Section]/Field). Store keys must match ^[A-Z][A-Z0-9_]{0,127}$.",
+        "propertyNames": { "pattern": "^[A-Z][A-Z0-9_]{0,127}$" },
+        "additionalProperties": {
+          "type": "string",
+          "pattern": "^op://"
+        },
+        "default": {}
+      },
+      "tools": {
+        "type": "object",
+        "additionalProperties": false,
+        "description": "Agent tool exposure.",
+        "properties": {
+          "enabled": {
+            "type": "boolean",
+            "description": "Register the read-only 1Password agent tools.",
+            "default": false
+          },
+          "allowWrite": {
+            "type": "boolean",
+            "description": "Also register create/update/delete tools. Requires `enabled`.",
+            "default": false
+          }
+        },
+        "default": {}
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "openclaw-plugin-onepassword",
+  "version": "0.1.0",
+  "description": "Native OpenClaw plugin that resolves 1Password secrets in-process (no exec sandbox), plus agent tools for vault/item CRUD.",
+  "keywords": [
+    "openclaw",
+    "openclaw-plugin",
+    "1password",
+    "onepassword",
+    "secrets",
+    "secret-provider",
+    "service-account",
+    "vault"
+  ],
+  "license": "MIT",
+  "author": "OpenClaw 1Password plugin contributors",
+  "homepage": "https://github.com/ioleksiy/openclaw-plugin-onepassword#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ioleksiy/openclaw-plugin-onepassword.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ioleksiy/openclaw-plugin-onepassword/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./resolver": {
+      "types": "./dist/resolver.d.ts",
+      "default": "./dist/resolver.js"
+    },
+    "./openclaw.plugin.json": "./openclaw.plugin.json"
+  },
+  "files": [
+    "dist",
+    "openclaw.plugin.json",
+    "examples",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "openclaw": {
+    "extensions": [
+      "./dist/index.js"
+    ],
+    "compat": {
+      "pluginApi": ">=2026.8.0",
+      "minGatewayVersion": "2026.8.0"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rimraf dist",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint . --max-warnings 0",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "verify": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run build",
+    "release:prepare": "node scripts/bump-version.mjs",
+    "prepack": "npm run clean && npm run build"
+  },
+  "dependencies": {
+    "@1password/sdk": "^0.5.0",
+    "typebox": "^1.3.17"
+  },
+  "peerDependencies": {
+    "openclaw": ">=2026.8.0"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.0.0",
+    "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^2.1.0",
+    "eslint": "^9.0.0",
+    "eslint-config-prettier": "^9.1.0",
+    "globals": "^15.0.0",
+    "openclaw": ">=2026.8.0",
+    "prettier": "^3.3.0",
+    "rimraf": "^6.0.0",
+    "typescript": "^5.6.0",
+    "typescript-eslint": "^8.0.0",
+    "vitest": "^2.1.0"
+  }
+}