import { Context, Duration, Effect, Semaphore } from "effect";import * as op from "@1password/op-js"; import { OnePasswordError } from "./errors"; // ---------------------------------------------------------------------------// Canonical service interface — all backends (SDK, CLI) implement this// --------------------------------------------------------------------------- export interface OnePasswordVault { readonly id: string; readonly title: string;} export interface OnePasswordItem { readonly id: string; readonly title: string;} export interface OnePasswordService { /** Resolve a secret by op:// URI */ readonly resolveSecret: (uri: string) => Effect.Effect<string, OnePasswordError>; /** List accessible vaults */ readonly listVaults: () => Effect.Effect<ReadonlyArray<OnePasswordVault>, OnePasswordError>; /** List items in a vault */ readonly listItems: ( vaultId: string, ) => Effect.Effect<ReadonlyArray<OnePasswordItem>, OnePasswordError>;} export class OnePasswordServiceTag extends Context.Service< OnePasswordServiceTag, OnePasswordService>()("@executor-js/plugin-onepassword/OnePasswordService") {} // ---------------------------------------------------------------------------// Resolved auth — raw credentials ready for any backend// --------------------------------------------------------------------------- export type ResolvedAuth = | { readonly kind: "desktop-app"; readonly accountName: string } | { readonly kind: "service-account"; readonly token: string }; // ---------------------------------------------------------------------------// SDK backend — uses @1password/sdk native IPC// --------------------------------------------------------------------------- const DEFAULT_TIMEOUT_MS = 15_000;type OnePasswordSdkModule = typeof import("@1password/sdk"); const loadOnePasswordSdk = (): Effect.Effect<OnePasswordSdkModule, OnePasswordError> => Effect.tryPromise({ try: () => import("@1password/sdk"), catch: () => new OnePasswordError({ operation: "sdk module load", message: "Failed to load 1Password SDK", }), }); const makeTimeoutMessage = (operation: string, timeoutMs: number): string => [ `${operation}: timed out after ${Math.floor(timeoutMs / 1000)}s.`, "Troubleshooting:", "1. Make sure the 1Password desktop app is open and unlocked", "2. Check for an approval prompt in the 1Password app — it may be behind other windows", "3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings", "4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)", "5. Try quitting 1Password completely and reopening it, then retry", ].join("\n"); const timeoutWithOnePasswordError = (operation: string, timeoutMs: number) => Effect.timeoutOrElse({ duration: Duration.millis(timeoutMs), orElse: () => Effect.fail( new OnePasswordError({ operation, message: makeTimeoutMessage(operation, timeoutMs), }), ), }); export const makeNativeSdkService = ( auth: ResolvedAuth, timeoutMs: number = DEFAULT_TIMEOUT_MS,): Effect.Effect<OnePasswordService, OnePasswordError> => Effect.gen(function* () { const sdk = yield* loadOnePasswordSdk().pipe( timeoutWithOnePasswordError("sdk module load", timeoutMs), ); const client = yield* Effect.tryPromise({ try: () => sdk.createClient({ auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token, integrationName: "Executor", integrationVersion: "0.0.0", }), catch: () => new OnePasswordError({ operation: "client setup", message: "Failed to set up 1Password client", }), }).pipe(timeoutWithOnePasswordError("client setup", timeoutMs)); const wrap = <A>(fn: () => Promise<A>, operation: string): Effect.Effect<A, OnePasswordError> => Effect.tryPromise({ try: fn, catch: () => new OnePasswordError({ operation, message: `1Password SDK ${operation} failed`, }), }).pipe( timeoutWithOnePasswordError(operation, timeoutMs), Effect.withSpan(`onepassword.sdk.${operation}`), ); return OnePasswordServiceTag.of({ resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"), listVaults: () => wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe( Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title }))), ), listItems: (vaultId) => wrap(() => client.items.list(vaultId), "item listing").pipe( Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))), ), }); }).pipe(Effect.withSpan("onepassword.sdk.make_service")); // ---------------------------------------------------------------------------// CLI backend — uses @1password/op-js (shells out to `op` CLI)// --------------------------------------------------------------------------- const cliAuthLock = Semaphore.makeUnsafe(1); export const makeCliService = ( auth: ResolvedAuth,): Effect.Effect<OnePasswordService, OnePasswordError> => Effect.sync(() => { const wrapSync = <A>(fn: () => A, operation: string): Effect.Effect<A, OnePasswordError> => cliAuthLock .withPermits(1)( Effect.try({ try: () => { if (auth.kind === "service-account") { op.setGlobalFlags({}); op.setServiceAccount(auth.token); } else { op.setServiceAccount(""); op.setGlobalFlags({ account: auth.accountName }); } return fn(); }, catch: () => new OnePasswordError({ operation, message: `1Password CLI ${operation} failed`, }), }), ) .pipe(Effect.withSpan(`onepassword.cli.${operation}`)); return OnePasswordServiceTag.of({ resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"), listVaults: () => wrapSync(() => op.vault.list(), "vault listing").pipe( Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name }))), ), listItems: (vaultId) => wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe( Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))), ), }); }).pipe(Effect.withSpan("onepassword.cli.make_service")); // ---------------------------------------------------------------------------// Smart factory — tries CLI first (avoids IPC hang), falls back to SDK// --------------------------------------------------------------------------- export const makeOnePasswordService = ( auth: ResolvedAuth, options?: { readonly preferSdk?: boolean; readonly timeoutMs?: number },): Effect.Effect<OnePasswordService, OnePasswordError> => { const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS; if (options?.preferSdk) { return makeNativeSdkService(auth, timeoutMs); } // Default: prefer CLI to avoid the IPC hang bug return makeCliService(auth).pipe( Effect.catch((cliError: OnePasswordError) => // CLI unavailable (e.g. `op` not installed) — fall back to SDK makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError)), ), );};
import { Context, Duration, Effect, Semaphore } from "effect";
import * as op from "@1password/op-js";
import { OnePasswordError } from "./errors";
// ---------------------------------------------------------------------------
// Canonical service interface — all backends (SDK, CLI) implement this
// ---------------------------------------------------------------------------
export interface OnePasswordVault {
readonly id: string;
readonly title: string;
}
export interface OnePasswordItem {
readonly id: string;
readonly title: string;
}
export interface OnePasswordService {
/** Resolve a secret by op:// URI */
readonly resolveSecret: (uri: string) => Effect.Effect<string, OnePasswordError>;
/** List accessible vaults */
readonly listVaults: () => Effect.Effect<ReadonlyArray<OnePasswordVault>, OnePasswordError>;
/** List items in a vault */
readonly listItems: (
vaultId: string,
) => Effect.Effect<ReadonlyArray<OnePasswordItem>, OnePasswordError>;
}
export class OnePasswordServiceTag extends Context.Service<
OnePasswordServiceTag,
OnePasswordService
>()("@executor-js/plugin-onepassword/OnePasswordService") {}
// ---------------------------------------------------------------------------
// Resolved auth — raw credentials ready for any backend
// ---------------------------------------------------------------------------
export type ResolvedAuth =
| { readonly kind: "desktop-app"; readonly accountName: string }
| { readonly kind: "service-account"; readonly token: string };
// ---------------------------------------------------------------------------
// SDK backend — uses @1password/sdk native IPC
// ---------------------------------------------------------------------------
const DEFAULT_TIMEOUT_MS = 15_000;
type OnePasswordSdkModule = typeof import("@1password/sdk");
const loadOnePasswordSdk = (): Effect.Effect<OnePasswordSdkModule, OnePasswordError> =>
Effect.tryPromise({
try: () => import("@1password/sdk"),
catch: () =>
new OnePasswordError({
operation: "sdk module load",
message: "Failed to load 1Password SDK",
}),
});
const makeTimeoutMessage = (operation: string, timeoutMs: number): string =>
[
`${operation}: timed out after ${Math.floor(timeoutMs / 1000)}s.`,
"Troubleshooting:",
"1. Make sure the 1Password desktop app is open and unlocked",
"2. Check for an approval prompt in the 1Password app — it may be behind other windows",
"3. Ensure 'Developer > Connect with 1Password CLI' is enabled in 1Password Settings",
"4. Make sure no other app or terminal is waiting for 1Password approval (only one prompt at a time)",
"5. Try quitting 1Password completely and reopening it, then retry",
].join("\n");
const timeoutWithOnePasswordError = (operation: string, timeoutMs: number) =>
Effect.timeoutOrElse({
duration: Duration.millis(timeoutMs),
orElse: () =>
Effect.fail(
new OnePasswordError({
operation,
message: makeTimeoutMessage(operation, timeoutMs),
}),
),
});
export const makeNativeSdkService = (
auth: ResolvedAuth,
timeoutMs: number = DEFAULT_TIMEOUT_MS,
): Effect.Effect<OnePasswordService, OnePasswordError> =>
Effect.gen(function* () {
const sdk = yield* loadOnePasswordSdk().pipe(
timeoutWithOnePasswordError("sdk module load", timeoutMs),
);
const client = yield* Effect.tryPromise({
try: () =>
sdk.createClient({
auth: auth.kind === "desktop-app" ? new sdk.DesktopAuth(auth.accountName) : auth.token,
integrationName: "Executor",
integrationVersion: "0.0.0",
}),
catch: () =>
new OnePasswordError({
operation: "client setup",
message: "Failed to set up 1Password client",
}),
}).pipe(timeoutWithOnePasswordError("client setup", timeoutMs));
const wrap = <A>(fn: () => Promise<A>, operation: string): Effect.Effect<A, OnePasswordError> =>
Effect.tryPromise({
try: fn,
catch: () =>
new OnePasswordError({
operation,
message: `1Password SDK ${operation} failed`,
}),
}).pipe(
timeoutWithOnePasswordError(operation, timeoutMs),
Effect.withSpan(`onepassword.sdk.${operation}`),
);
return OnePasswordServiceTag.of({
resolveSecret: (uri) => wrap(() => client.secrets.resolve(uri), "secret resolution"),
listVaults: () =>
wrap(() => client.vaults.list({ decryptDetails: true }), "vault listing").pipe(
Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.title }))),
),
listItems: (vaultId) =>
wrap(() => client.items.list(vaultId), "item listing").pipe(
Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),
),
});
}).pipe(Effect.withSpan("onepassword.sdk.make_service"));
// ---------------------------------------------------------------------------
// CLI backend — uses @1password/op-js (shells out to `op` CLI)
// ---------------------------------------------------------------------------
const cliAuthLock = Semaphore.makeUnsafe(1);
export const makeCliService = (
auth: ResolvedAuth,
): Effect.Effect<OnePasswordService, OnePasswordError> =>
Effect.sync(() => {
const wrapSync = <A>(fn: () => A, operation: string): Effect.Effect<A, OnePasswordError> =>
cliAuthLock
.withPermits(1)(
Effect.try({
try: () => {
if (auth.kind === "service-account") {
op.setGlobalFlags({});
op.setServiceAccount(auth.token);
} else {
op.setServiceAccount("");
op.setGlobalFlags({ account: auth.accountName });
}
return fn();
},
catch: () =>
new OnePasswordError({
operation,
message: `1Password CLI ${operation} failed`,
}),
}),
)
.pipe(Effect.withSpan(`onepassword.cli.${operation}`));
return OnePasswordServiceTag.of({
resolveSecret: (uri) => wrapSync(() => op.read.parse(uri), "secret resolution"),
listVaults: () =>
wrapSync(() => op.vault.list(), "vault listing").pipe(
Effect.map((vaults) => vaults.map((v) => ({ id: v.id, title: v.name }))),
),
listItems: (vaultId) =>
wrapSync(() => op.item.list({ vault: vaultId }), "item listing").pipe(
Effect.map((items) => items.map((i) => ({ id: i.id, title: i.title }))),
),
});
}).pipe(Effect.withSpan("onepassword.cli.make_service"));
// ---------------------------------------------------------------------------
// Smart factory — tries CLI first (avoids IPC hang), falls back to SDK
// ---------------------------------------------------------------------------
export const makeOnePasswordService = (
auth: ResolvedAuth,
options?: { readonly preferSdk?: boolean; readonly timeoutMs?: number },
): Effect.Effect<OnePasswordService, OnePasswordError> => {
const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
if (options?.preferSdk) {
return makeNativeSdkService(auth, timeoutMs);
}
// Default: prefer CLI to avoid the IPC hang bug
return makeCliService(auth).pipe(
Effect.catch((cliError: OnePasswordError) =>
// CLI unavailable (e.g. `op` not installed) — fall back to SDK
makeNativeSdkService(auth, timeoutMs).pipe(Effect.mapError(() => cliError)),
),
);
};