import { Effect, Schema } from "effect"; import { definePlugin, StorageError, ToolResult, tool, type PluginCtx, type PluginBlobStore, type SecretProvider, type StaticToolSchema, type StorageFailure,} from "@executor-js/sdk/core"; import { OnePasswordAuth, OnePasswordConfig, Vault, ConnectionStatus } from "./types";import { OnePasswordError } from "./errors";import { makeOnePasswordService, type ResolvedAuth, type OnePasswordService } from "./service"; // ---------------------------------------------------------------------------// Constants// --------------------------------------------------------------------------- const CREDENTIAL_FIELD = "credential";const DEFAULT_TIMEOUT_MS = 15_000;const CONFIG_KEY = "config"; const schemaToStaticToolSchema = <A, I>(schema: Schema.Decoder<A, I>): StaticToolSchema<A, I> => Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema) as never) as StaticToolSchema< A, I >; const OnePasswordConfigureInput = Schema.Struct({ scope: Schema.String, auth: OnePasswordAuth, vaultId: Schema.String, name: Schema.String,}); const OnePasswordConfigureOutput = Schema.Struct({ configured: Schema.Boolean,}); const OnePasswordGetConfigOutput = Schema.Struct({ config: Schema.NullOr(OnePasswordConfig),}); const OnePasswordListVaultsInput = OnePasswordAuth; const OnePasswordListVaultsOutput = Schema.Struct({ vaults: Schema.Array(Vault),}); const OnePasswordRemoveConfigInput = Schema.Struct({ targetScope: Schema.String,}); const OnePasswordRemoveConfigOutput = Schema.Struct({ removed: Schema.Boolean,}); const OnePasswordStatusOutput = ConnectionStatus; const OnePasswordConfigureInputStd = schemaToStaticToolSchema< typeof OnePasswordConfigureInput.Type, typeof OnePasswordConfigureInput.Encoded>(OnePasswordConfigureInput);const OnePasswordConfigureOutputStd = schemaToStaticToolSchema(OnePasswordConfigureOutput);const OnePasswordGetConfigOutputStd = schemaToStaticToolSchema(OnePasswordGetConfigOutput);const OnePasswordListVaultsInputStd = schemaToStaticToolSchema< typeof OnePasswordListVaultsInput.Type, typeof OnePasswordListVaultsInput.Encoded>(OnePasswordListVaultsInput);const OnePasswordListVaultsOutputStd = schemaToStaticToolSchema(OnePasswordListVaultsOutput);const OnePasswordRemoveConfigInputStd = schemaToStaticToolSchema< typeof OnePasswordRemoveConfigInput.Type, typeof OnePasswordRemoveConfigInput.Encoded>(OnePasswordRemoveConfigInput);const OnePasswordRemoveConfigOutputStd = schemaToStaticToolSchema(OnePasswordRemoveConfigOutput);const OnePasswordStatusOutputStd = schemaToStaticToolSchema(OnePasswordStatusOutput); // ---------------------------------------------------------------------------// Shared failure alias.//// Every extension method either touches storage (`ctx.storage` blobs or// `ctx.secrets`) or reaches the 1Password backend. Storage I/O surfaces// as `StorageFailure`; the HTTP edge (`withCapture`) translates// `StorageError` to `InternalError({ traceId })`. Domain problems (not// configured, service-account token missing, backend RPC failure) stay// as `OnePasswordError` and encode to 502 via the schema annotation on// the class.// --------------------------------------------------------------------------- export type OnePasswordExtensionFailure = OnePasswordError | StorageFailure; // ---------------------------------------------------------------------------// Plugin extension — public API on executor.onepassword// --------------------------------------------------------------------------- // ---------------------------------------------------------------------------// Typed config store — single blob, JSON encoded. Blob I/O failures surface// as `StorageError` (HTTP edge translates to `InternalError`); decode// failures stay `OnePasswordError` — the blob's contents are a plugin// concern, not an infrastructure one.// --------------------------------------------------------------------------- export interface OnePasswordStore { readonly getConfig: () => Effect.Effect< OnePasswordConfig | null, StorageError | OnePasswordError >; readonly saveConfig: ( config: OnePasswordConfig, targetScope: string, ) => Effect.Effect<void, StorageError>; readonly deleteConfig: (targetScope: string) => Effect.Effect<void, StorageError>;} const decodeConfig = Schema.decodeUnknownEffect(Schema.fromJsonString(OnePasswordConfig)); const blobStorageError = (operation: string) => (cause: unknown): StorageError => new StorageError({ message: `onepassword blob ${operation} failed`, cause, }); export const makeOnePasswordStore = (blobs: PluginBlobStore): OnePasswordStore => ({ getConfig: () => blobs.get(CONFIG_KEY).pipe( Effect.mapError(blobStorageError("read")), Effect.flatMap((raw) => { if (raw === null) return Effect.succeed(null); return decodeConfig(raw).pipe( Effect.mapError( () => new OnePasswordError({ operation: "config decode", message: "Failed to decode 1Password config", }), ), ); }), ), saveConfig: (config, targetScope) => blobs .put( CONFIG_KEY, JSON.stringify({ auth: config.auth, vaultId: config.vaultId, name: config.name, }), { scope: targetScope }, ) .pipe(Effect.mapError(blobStorageError("write"))), deleteConfig: (targetScope) => blobs .delete(CONFIG_KEY, { scope: targetScope }) .pipe(Effect.mapError(blobStorageError("delete"))),}); // ---------------------------------------------------------------------------// Helpers — auth resolution + service construction// --------------------------------------------------------------------------- const resolveAuth = ( auth: OnePasswordAuth, ctx: PluginCtx<OnePasswordStore>,): Effect.Effect<ResolvedAuth, OnePasswordError | StorageFailure> => { if (auth.kind === "desktop-app") { return Effect.succeed({ kind: "desktop-app" as const, accountName: auth.accountName, }); } return ctx.secrets.get(auth.tokenSecretId).pipe( Effect.catchTag("SecretOwnedByConnectionError", () => Effect.fail( new OnePasswordError({ operation: "auth resolution", message: `Service account token secret "${auth.tokenSecretId}" not found`, }), ), ), Effect.flatMap((token) => { if (token === null) { return Effect.fail( new OnePasswordError({ operation: "auth resolution", message: `Service account token secret "${auth.tokenSecretId}" not found`, }), ); } return Effect.succeed({ kind: "service-account" as const, token, }); }), );}; const getServiceFromConfig = ( config: OnePasswordConfig, ctx: PluginCtx<OnePasswordStore>, timeoutMs: number, preferSdk: boolean | undefined,): Effect.Effect<OnePasswordService, OnePasswordError | StorageFailure> => resolveAuth(config.auth, ctx).pipe( Effect.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs, preferSdk })), ); const configuredVaultUri = (config: OnePasswordConfig, secretId: string): string | null => { if (!secretId.startsWith("op://")) { return `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`; } const match = secretId.match(/^op:\/\/([^/]+)\/.+/); if (!match || match[1] !== config.vaultId) return null; return secretId;}; // ---------------------------------------------------------------------------// SecretProvider — read-only, resolves op:// URIs or vaultId-based lookups// --------------------------------------------------------------------------- const makeProvider = ( ctx: PluginCtx<OnePasswordStore>, timeoutMs: number, preferSdk: boolean | undefined,): SecretProvider => ({ key: "onepassword", writable: false, allowFallback: false, // 1Password vaults are named in the stored config; the executor-scope // arg isn't used for routing here. A future refactor could let the // plugin store per-scope vault bindings and pick based on `scope`. get: (secretId, _scope) => ctx.storage.getConfig().pipe( Effect.flatMap((config) => { if (!config) return Effect.succeed(null as string | null); const uri = configuredVaultUri(config, secretId); if (uri === null) return Effect.succeed(null as string | null); return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe( Effect.flatMap((svc) => svc.resolveSecret(uri)), Effect.map((v): string | null => v), Effect.orElseSucceed(() => null), ); }), Effect.orElseSucceed(() => null), ), list: () => ctx.storage.getConfig().pipe( Effect.flatMap((config) => { if (!config) return Effect.succeed([] as ReadonlyArray<{ id: string; name: string }>); return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe( Effect.flatMap((svc) => svc.listItems(config.vaultId)), Effect.map( (items): ReadonlyArray<{ id: string; name: string }> => items.map((item) => ({ id: item.id, name: item.title })), ), ); }), Effect.orElseSucceed(() => [] as ReadonlyArray<{ id: string; name: string }>), ),}); const makeOnePasswordExtension = ( ctx: PluginCtx<OnePasswordStore>, timeoutMs: number, preferSdk: boolean | undefined,) => { return { configure: (config: OnePasswordConfig, targetScope: string) => ctx.storage.saveConfig(config, targetScope), getConfig: () => ctx.storage.getConfig(), removeConfig: (targetScope: string) => ctx.storage.deleteConfig(targetScope), status: () => Effect.gen(function* () { const config = yield* ctx.storage.getConfig(); if (!config) { return ConnectionStatus.make({ connected: false, error: "Not configured", }); } const svc = yield* getServiceFromConfig(config, ctx, timeoutMs, preferSdk); const vaults = yield* svc.listVaults(); const vault = vaults.find((v) => v.id === config.vaultId); return ConnectionStatus.make({ connected: true, vaultName: vault?.title, }); }), listVaults: (auth: OnePasswordAuth) => Effect.gen(function* () { const resolved = yield* resolveAuth(auth, ctx); const svc = yield* makeOnePasswordService(resolved, { timeoutMs, preferSdk, }); const vaults = yield* svc.listVaults(); return vaults .map((v) => Vault.make({ id: v.id, name: v.title })) .sort((a, b) => a.name.localeCompare(b.name)); }), resolve: (uri: string) => Effect.gen(function* () { const config = yield* ctx.storage.getConfig(); if (!config) { return yield* new OnePasswordError({ operation: "resolve", message: "1Password is not configured", }); } const scopedUri = configuredVaultUri(config, uri); if (scopedUri === null) { return yield* new OnePasswordError({ operation: "resolve", message: "1Password secret URI is outside the configured vault", }); } const svc = yield* getServiceFromConfig(config, ctx, timeoutMs, preferSdk); return yield* svc.resolveSecret(scopedUri); }), };}; export type OnePasswordExtension = ReturnType<typeof makeOnePasswordExtension>; // ---------------------------------------------------------------------------// Plugin factory// --------------------------------------------------------------------------- export interface OnePasswordPluginOptions { /** Request timeout in ms (default: 15000) */ readonly timeoutMs?: number; /** Force use of the native SDK instead of the CLI (default: false) */ readonly preferSdk?: boolean;} export const onepasswordPlugin = definePlugin((options?: OnePasswordPluginOptions) => { const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS; const preferSdk = options?.preferSdk; return { id: "onepassword" as const, packageName: "@executor-js/plugin-onepassword", storage: ({ blobs }) => makeOnePasswordStore(blobs), extension: (ctx) => makeOnePasswordExtension(ctx, timeoutMs, preferSdk), staticSources: (self) => [ { id: "onepassword", kind: "executor", name: "1Password", tools: [ tool({ name: "status", description: "Check whether the 1Password secret provider is configured and can reach its selected vault. This returns status only, never secret values.", outputSchema: OnePasswordStatusOutputStd, execute: () => Effect.map(self.status(), ToolResult.ok), }), tool({ name: "getConfig", description: "Read the current 1Password provider configuration. This returns account/vault metadata and secret ids only; service-account token values are never returned.", outputSchema: OnePasswordGetConfigOutputStd, execute: () => Effect.map(self.getConfig(), (config) => ToolResult.ok({ config })), }), tool({ name: "listVaults", description: "List available 1Password vaults before configuring the provider. For service-account auth, first call `executor.coreTools.secrets.create` so the token is entered in the browser, then pass that token secret id here.", inputSchema: OnePasswordListVaultsInputStd, outputSchema: OnePasswordListVaultsOutputStd, execute: (input) => Effect.map(self.listVaults(input), (vaults) => ToolResult.ok({ vaults })), }), tool({ name: "configure", description: "Configure the 1Password secret provider for a target executor scope. Use desktop-app auth for local biometric access, or service-account auth with a token secret id created through `executor.coreTools.secrets.create`; never ask the user to paste the token in chat.", annotations: { requiresApproval: true, approvalDescription: "Configure the 1Password secret provider", }, inputSchema: OnePasswordConfigureInputStd, outputSchema: OnePasswordConfigureOutputStd, execute: (input) => Effect.as( self.configure( { auth: input.auth, vaultId: input.vaultId, name: input.name }, input.scope, ), ToolResult.ok({ configured: true }), ), }), tool({ name: "removeConfig", description: "Remove the 1Password provider configuration from a target scope. Existing secrets are not revealed; future 1Password secret resolution will stop until reconfigured.", annotations: { requiresApproval: true, approvalDescription: "Remove the 1Password secret provider configuration", }, inputSchema: OnePasswordRemoveConfigInputStd, outputSchema: OnePasswordRemoveConfigOutputStd, execute: (input) => Effect.as(self.removeConfig(input.targetScope), ToolResult.ok({ removed: true })), }), ], }, ], secretProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)], }; // HTTP transport (routes/handlers/extensionService) is layered on by // the api-aware factory in `@executor-js/plugin-onepassword/api`. Hosts // that want the HTTP surface import the plugin from there; SDK-only // consumers stay on this entry and avoid the server-only deps.});
import { Effect, Schema } from "effect";
import {
definePlugin,
StorageError,
ToolResult,
tool,
type PluginCtx,
type PluginBlobStore,
type SecretProvider,
type StaticToolSchema,
type StorageFailure,
} from "@executor-js/sdk/core";
import { OnePasswordAuth, OnePasswordConfig, Vault, ConnectionStatus } from "./types";
import { OnePasswordError } from "./errors";
import { makeOnePasswordService, type ResolvedAuth, type OnePasswordService } from "./service";
// ---------------------------------------------------------------------------
// Constants
// ---------------------------------------------------------------------------
const CREDENTIAL_FIELD = "credential";
const DEFAULT_TIMEOUT_MS = 15_000;
const CONFIG_KEY = "config";
const schemaToStaticToolSchema = <A, I>(schema: Schema.Decoder<A, I>): StaticToolSchema<A, I> =>
Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema) as never) as StaticToolSchema<
A,
I
>;
const OnePasswordConfigureInput = Schema.Struct({
scope: Schema.String,
auth: OnePasswordAuth,
vaultId: Schema.String,
name: Schema.String,
});
const OnePasswordConfigureOutput = Schema.Struct({
configured: Schema.Boolean,
});
const OnePasswordGetConfigOutput = Schema.Struct({
config: Schema.NullOr(OnePasswordConfig),
});
const OnePasswordListVaultsInput = OnePasswordAuth;
const OnePasswordListVaultsOutput = Schema.Struct({
vaults: Schema.Array(Vault),
});
const OnePasswordRemoveConfigInput = Schema.Struct({
targetScope: Schema.String,
});
const OnePasswordRemoveConfigOutput = Schema.Struct({
removed: Schema.Boolean,
});
const OnePasswordStatusOutput = ConnectionStatus;
const OnePasswordConfigureInputStd = schemaToStaticToolSchema<
typeof OnePasswordConfigureInput.Type,
typeof OnePasswordConfigureInput.Encoded
>(OnePasswordConfigureInput);
const OnePasswordConfigureOutputStd = schemaToStaticToolSchema(OnePasswordConfigureOutput);
const OnePasswordGetConfigOutputStd = schemaToStaticToolSchema(OnePasswordGetConfigOutput);
const OnePasswordListVaultsInputStd = schemaToStaticToolSchema<
typeof OnePasswordListVaultsInput.Type,
typeof OnePasswordListVaultsInput.Encoded
>(OnePasswordListVaultsInput);
const OnePasswordListVaultsOutputStd = schemaToStaticToolSchema(OnePasswordListVaultsOutput);
const OnePasswordRemoveConfigInputStd = schemaToStaticToolSchema<
typeof OnePasswordRemoveConfigInput.Type,
typeof OnePasswordRemoveConfigInput.Encoded
>(OnePasswordRemoveConfigInput);
const OnePasswordRemoveConfigOutputStd = schemaToStaticToolSchema(OnePasswordRemoveConfigOutput);
const OnePasswordStatusOutputStd = schemaToStaticToolSchema(OnePasswordStatusOutput);
// ---------------------------------------------------------------------------
// Shared failure alias.
//
// Every extension method either touches storage (`ctx.storage` blobs or
// `ctx.secrets`) or reaches the 1Password backend. Storage I/O surfaces
// as `StorageFailure`; the HTTP edge (`withCapture`) translates
// `StorageError` to `InternalError({ traceId })`. Domain problems (not
// configured, service-account token missing, backend RPC failure) stay
// as `OnePasswordError` and encode to 502 via the schema annotation on
// the class.
// ---------------------------------------------------------------------------
export type OnePasswordExtensionFailure = OnePasswordError | StorageFailure;
// ---------------------------------------------------------------------------
// Plugin extension — public API on executor.onepassword
// ---------------------------------------------------------------------------
// ---------------------------------------------------------------------------
// Typed config store — single blob, JSON encoded. Blob I/O failures surface
// as `StorageError` (HTTP edge translates to `InternalError`); decode
// failures stay `OnePasswordError` — the blob's contents are a plugin
// concern, not an infrastructure one.
// ---------------------------------------------------------------------------
export interface OnePasswordStore {
readonly getConfig: () => Effect.Effect<
OnePasswordConfig | null,
StorageError | OnePasswordError
>;
readonly saveConfig: (
config: OnePasswordConfig,
targetScope: string,
) => Effect.Effect<void, StorageError>;
readonly deleteConfig: (targetScope: string) => Effect.Effect<void, StorageError>;
}
const decodeConfig = Schema.decodeUnknownEffect(Schema.fromJsonString(OnePasswordConfig));
const blobStorageError =
(operation: string) =>
(cause: unknown): StorageError =>
new StorageError({
message: `onepassword blob ${operation} failed`,
cause,
});
export const makeOnePasswordStore = (blobs: PluginBlobStore): OnePasswordStore => ({
getConfig: () =>
blobs.get(CONFIG_KEY).pipe(
Effect.mapError(blobStorageError("read")),
Effect.flatMap((raw) => {
if (raw === null) return Effect.succeed(null);
return decodeConfig(raw).pipe(
Effect.mapError(
() =>
new OnePasswordError({
operation: "config decode",
message: "Failed to decode 1Password config",
}),
),
);
}),
),
saveConfig: (config, targetScope) =>
blobs
.put(
CONFIG_KEY,
JSON.stringify({
auth: config.auth,
vaultId: config.vaultId,
name: config.name,
}),
{ scope: targetScope },
)
.pipe(Effect.mapError(blobStorageError("write"))),
deleteConfig: (targetScope) =>
blobs
.delete(CONFIG_KEY, { scope: targetScope })
.pipe(Effect.mapError(blobStorageError("delete"))),
});
// ---------------------------------------------------------------------------
// Helpers — auth resolution + service construction
// ---------------------------------------------------------------------------
const resolveAuth = (
auth: OnePasswordAuth,
ctx: PluginCtx<OnePasswordStore>,
): Effect.Effect<ResolvedAuth, OnePasswordError | StorageFailure> => {
if (auth.kind === "desktop-app") {
return Effect.succeed({
kind: "desktop-app" as const,
accountName: auth.accountName,
});
}
return ctx.secrets.get(auth.tokenSecretId).pipe(
Effect.catchTag("SecretOwnedByConnectionError", () =>
Effect.fail(
new OnePasswordError({
operation: "auth resolution",
message: `Service account token secret "${auth.tokenSecretId}" not found`,
}),
),
),
Effect.flatMap((token) => {
if (token === null) {
return Effect.fail(
new OnePasswordError({
operation: "auth resolution",
message: `Service account token secret "${auth.tokenSecretId}" not found`,
}),
);
}
return Effect.succeed({
kind: "service-account" as const,
token,
});
}),
);
};
const getServiceFromConfig = (
config: OnePasswordConfig,
ctx: PluginCtx<OnePasswordStore>,
timeoutMs: number,
preferSdk: boolean | undefined,
): Effect.Effect<OnePasswordService, OnePasswordError | StorageFailure> =>
resolveAuth(config.auth, ctx).pipe(
Effect.flatMap((resolved) => makeOnePasswordService(resolved, { timeoutMs, preferSdk })),
);
const configuredVaultUri = (config: OnePasswordConfig, secretId: string): string | null => {
if (!secretId.startsWith("op://")) {
return `op://${config.vaultId}/${secretId}/${CREDENTIAL_FIELD}`;
}
const match = secretId.match(/^op:\/\/([^/]+)\/.+/);
if (!match || match[1] !== config.vaultId) return null;
return secretId;
};
// ---------------------------------------------------------------------------
// SecretProvider — read-only, resolves op:// URIs or vaultId-based lookups
// ---------------------------------------------------------------------------
const makeProvider = (
ctx: PluginCtx<OnePasswordStore>,
timeoutMs: number,
preferSdk: boolean | undefined,
): SecretProvider => ({
key: "onepassword",
writable: false,
allowFallback: false,
// 1Password vaults are named in the stored config; the executor-scope
// arg isn't used for routing here. A future refactor could let the
// plugin store per-scope vault bindings and pick based on `scope`.
get: (secretId, _scope) =>
ctx.storage.getConfig().pipe(
Effect.flatMap((config) => {
if (!config) return Effect.succeed(null as string | null);
const uri = configuredVaultUri(config, secretId);
if (uri === null) return Effect.succeed(null as string | null);
return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
Effect.flatMap((svc) => svc.resolveSecret(uri)),
Effect.map((v): string | null => v),
Effect.orElseSucceed(() => null),
);
}),
Effect.orElseSucceed(() => null),
),
list: () =>
ctx.storage.getConfig().pipe(
Effect.flatMap((config) => {
if (!config) return Effect.succeed([] as ReadonlyArray<{ id: string; name: string }>);
return getServiceFromConfig(config, ctx, timeoutMs, preferSdk).pipe(
Effect.flatMap((svc) => svc.listItems(config.vaultId)),
Effect.map(
(items): ReadonlyArray<{ id: string; name: string }> =>
items.map((item) => ({ id: item.id, name: item.title })),
),
);
}),
Effect.orElseSucceed(() => [] as ReadonlyArray<{ id: string; name: string }>),
),
});
const makeOnePasswordExtension = (
ctx: PluginCtx<OnePasswordStore>,
timeoutMs: number,
preferSdk: boolean | undefined,
) => {
return {
configure: (config: OnePasswordConfig, targetScope: string) =>
ctx.storage.saveConfig(config, targetScope),
getConfig: () => ctx.storage.getConfig(),
removeConfig: (targetScope: string) => ctx.storage.deleteConfig(targetScope),
status: () =>
Effect.gen(function* () {
const config = yield* ctx.storage.getConfig();
if (!config) {
return ConnectionStatus.make({
connected: false,
error: "Not configured",
});
}
const svc = yield* getServiceFromConfig(config, ctx, timeoutMs, preferSdk);
const vaults = yield* svc.listVaults();
const vault = vaults.find((v) => v.id === config.vaultId);
return ConnectionStatus.make({
connected: true,
vaultName: vault?.title,
});
}),
listVaults: (auth: OnePasswordAuth) =>
Effect.gen(function* () {
const resolved = yield* resolveAuth(auth, ctx);
const svc = yield* makeOnePasswordService(resolved, {
timeoutMs,
preferSdk,
});
const vaults = yield* svc.listVaults();
return vaults
.map((v) => Vault.make({ id: v.id, name: v.title }))
.sort((a, b) => a.name.localeCompare(b.name));
}),
resolve: (uri: string) =>
Effect.gen(function* () {
const config = yield* ctx.storage.getConfig();
if (!config) {
return yield* new OnePasswordError({
operation: "resolve",
message: "1Password is not configured",
});
}
const scopedUri = configuredVaultUri(config, uri);
if (scopedUri === null) {
return yield* new OnePasswordError({
operation: "resolve",
message: "1Password secret URI is outside the configured vault",
});
}
const svc = yield* getServiceFromConfig(config, ctx, timeoutMs, preferSdk);
return yield* svc.resolveSecret(scopedUri);
}),
};
};
export type OnePasswordExtension = ReturnType<typeof makeOnePasswordExtension>;
// ---------------------------------------------------------------------------
// Plugin factory
// ---------------------------------------------------------------------------
export interface OnePasswordPluginOptions {
/** Request timeout in ms (default: 15000) */
readonly timeoutMs?: number;
/** Force use of the native SDK instead of the CLI (default: false) */
readonly preferSdk?: boolean;
}
export const onepasswordPlugin = definePlugin((options?: OnePasswordPluginOptions) => {
const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
const preferSdk = options?.preferSdk;
return {
id: "onepassword" as const,
packageName: "@executor-js/plugin-onepassword",
storage: ({ blobs }) => makeOnePasswordStore(blobs),
extension: (ctx) => makeOnePasswordExtension(ctx, timeoutMs, preferSdk),
staticSources: (self) => [
{
id: "onepassword",
kind: "executor",
name: "1Password",
tools: [
tool({
name: "status",
description:
"Check whether the 1Password secret provider is configured and can reach its selected vault. This returns status only, never secret values.",
outputSchema: OnePasswordStatusOutputStd,
execute: () => Effect.map(self.status(), ToolResult.ok),
}),
tool({
name: "getConfig",
description:
"Read the current 1Password provider configuration. This returns account/vault metadata and secret ids only; service-account token values are never returned.",
outputSchema: OnePasswordGetConfigOutputStd,
execute: () => Effect.map(self.getConfig(), (config) => ToolResult.ok({ config })),
}),
tool({
name: "listVaults",
description:
"List available 1Password vaults before configuring the provider. For service-account auth, first call `executor.coreTools.secrets.create` so the token is entered in the browser, then pass that token secret id here.",
inputSchema: OnePasswordListVaultsInputStd,
outputSchema: OnePasswordListVaultsOutputStd,
execute: (input) =>
Effect.map(self.listVaults(input), (vaults) => ToolResult.ok({ vaults })),
}),
tool({
name: "configure",
description:
"Configure the 1Password secret provider for a target executor scope. Use desktop-app auth for local biometric access, or service-account auth with a token secret id created through `executor.coreTools.secrets.create`; never ask the user to paste the token in chat.",
annotations: {
requiresApproval: true,
approvalDescription: "Configure the 1Password secret provider",
},
inputSchema: OnePasswordConfigureInputStd,
outputSchema: OnePasswordConfigureOutputStd,
execute: (input) =>
Effect.as(
self.configure(
{ auth: input.auth, vaultId: input.vaultId, name: input.name },
input.scope,
),
ToolResult.ok({ configured: true }),
),
}),
tool({
name: "removeConfig",
description:
"Remove the 1Password provider configuration from a target scope. Existing secrets are not revealed; future 1Password secret resolution will stop until reconfigured.",
annotations: {
requiresApproval: true,
approvalDescription: "Remove the 1Password secret provider configuration",
},
inputSchema: OnePasswordRemoveConfigInputStd,
outputSchema: OnePasswordRemoveConfigOutputStd,
execute: (input) =>
Effect.as(self.removeConfig(input.targetScope), ToolResult.ok({ removed: true })),
}),
],
},
],
secretProviders: (ctx) => [makeProvider(ctx, timeoutMs, preferSdk)],
};
// HTTP transport (routes/handlers/extensionService) is layered on by
// the api-aware factory in `@executor-js/plugin-onepassword/api`. Hosts
// that want the HTTP surface import the plugin from there; SDK-only
// consumers stay on this entry and avoid the server-only deps.
});