fix(1password): remove agent friction points in secret reads #33

Merged

adam merged 1 commit from fix/1password-agent-friction into main

2026-10-12 19:05:46 -05:00

adam commented

2026-10-12 17:52:53 -05:00

Owner

Fixes the 1Password friction points found while reviewing past agent sessions (items 2–4 of the review).

Changes

forgejo-api skill: removed op://foundry/Forgejo Adam Token/credential. That item doesn't exist, and the read failed with "isn't an item in the foundry vault" in ~9 sessions. The skill now uses forgejo/api_token. The Contents-API examples also used a bare op read, which triggers the biometric prompt; they now use the wrapper.
scripts/op-read <item>/<field>: a wrapper that always uses the read-only service account token and clears any OP_CONNECT_* vars. Agents can't forget the prefix, and one allow rule replaces the per-secret ones. The op-secrets skill now leads with it.
docs/runbooks/vault-structure.md: rebuilt from the live vault (field labels only). Lists active items, retired-service items that can be archived (connect, hindsight, mem0, omniroute), the empty postgres item, and secrets that aren't in the vault.
Stale references:
- Fixed the old SSH key ID i3hj… → jnsy… in add-vm.md and vm-bootstrap.sh.
- pangolin/license_key has no matching field. The rebuild doc and VPS README now say the key isn't in 1Password yet.
Connect cleanup: deleted the retired Connect runbook, plan and container docs. Removed the Connect rows from lan-endpoints.md and unraid-server.md, and fixed the OP_CONNECT_* read command in the hermes handoff doc.

Verification

scripts/op-read dockhand/api_key and forgejo/api_token both resolve. A missing item fails loudly (exit 1).
After this change, every op://foundry/... reference in live docs resolves, apart from the deliberate "not stored" notes.

Not in this PR

Removed the OP_SERVICE_TOKEN export from ~/.zshrc (Adam did this).
Cleaned up the allow list in .claude/settings.local.json, which is gitignored: removed 10 per-secret rules, including cat service_token, and added Bash(scripts/op-read *).

🤖 Generated with Claude Code

Fixes the 1Password friction points found while reviewing past agent sessions (items 2–4 of the review). ## Changes - **forgejo-api skill:** removed `op://foundry/Forgejo Adam Token/credential`. That item doesn't exist, and the read failed with "isn't an item in the foundry vault" in ~9 sessions. The skill now uses `forgejo/api_token`. The Contents-API examples also used a bare `op read`, which triggers the biometric prompt; they now use the wrapper. - **`scripts/op-read <item>/<field>`:** a wrapper that always uses the read-only service account token and clears any `OP_CONNECT_*` vars. Agents can't forget the prefix, and one allow rule replaces the per-secret ones. The op-secrets skill now leads with it. - **`docs/runbooks/vault-structure.md`:** rebuilt from the live vault (field labels only). Lists active items, retired-service items that can be archived (`connect`, `hindsight`, `mem0`, `omniroute`), the empty `postgres` item, and secrets that aren't in the vault. - **Stale references:** - Fixed the old SSH key ID `i3hj…` → `jnsy…` in `add-vm.md` and `vm-bootstrap.sh`. - `pangolin/license_key` has no matching field. The rebuild doc and VPS README now say the key isn't in 1Password yet. - **Connect cleanup:** deleted the retired Connect runbook, plan and container docs. Removed the Connect rows from `lan-endpoints.md` and `unraid-server.md`, and fixed the `OP_CONNECT_*` read command in the hermes handoff doc. ## Verification - `scripts/op-read dockhand/api_key` and `forgejo/api_token` both resolve. A missing item fails loudly (exit 1). - After this change, every `op://foundry/...` reference in live docs resolves, apart from the deliberate "not stored" notes. ## Not in this PR - Removed the `OP_SERVICE_TOKEN` export from `~/.zshrc` (Adam did this). - Cleaned up the allow list in `.claude/settings.local.json`, which is gitignored: removed 10 per-secret rules, including `cat service_token`, and added `Bash(scripts/op-read *)`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

adam added 1 commit

2026-10-12 17:52:53 -05:00

fix(1password): remove agent friction points in secret reads 0962eb6fae

- forgejo-api skill: drop the nonexistent `Forgejo Adam Token` item (failed
  in ~9 sessions); point at `forgejo/api_token`; no bare `op read`.
- Add scripts/op-read: pins the read-only service account token so reads
  never fall back to the biometric prompt; op-secrets skill now leads with it.
- vault-structure.md rebuilt from the live vault (labels only); flags
  retired-service items and secrets not stored in 1Password.
- Fix stale SSH key ID in add-vm.md / vm-bootstrap.sh; correct the Pangolin
  license_key references (field does not exist).
- Remove retired 1Password Connect docs and Connect rows/commands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

adam merged commit 6ac942afb1 into main

2026-10-12 19:05:46 -05:00

adam referenced this pull request from a commit

2026-10-12 19:05:47 -05:00

Merge pull request 'fix(1password): remove agent friction points in secret reads' (#33) from fix/1password-agent-friction into main