Skip to content

Commit 0afe6c0

Browse files
nsheapsclaudeautomation-nsheaps[bot]
authored
feat(1pass): add userSettingsJson target for secrets (#310)
* feat: add braintrust plugin and configure plugin settings - Add braintrust plugin with README and manifest - Update plugins.settings.yaml with braintrust config - Update settings.json with plugin configuration - Improve 1pass plugin settings and install script - Enhance plugin-config-read.sh shared library * chore: `just lint` * chore: `just lint` * chore: replace local braintrust plugin with upstream braintrustdata marketplace - Remove plugins/braintrust/ (local stub) - Add braintrustdata/braintrust-claude-plugin as extraKnownMarketplaces entry - Enable braintrust@braintrust plugin in enabledPlugins https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * fix: enable trace-claude-code@braintrust instead of braintrust@braintrust https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * chore: `just lint` * fix: use braintrust-claude-plugin as marketplace key for trace-claude-code Fixes install failure - the CLI uses the marketplace's own name field (braintrust-claude-plugin) not the alias (braintrust). https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * chore: rename braintrust marketplace key to poc-braintrust https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * chore: `mise run lint` * Revert "chore: rename braintrust marketplace key to poc-braintrust" This reverts commit f6ce578. * feat: rename 1pass plugin to poc-1pass https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * feat: rename poc-1pass plugin back to 1pass Reverts the poc- prefix added earlier. Updates all internal references including plugin.json name, settings key, PLUGIN_NAME, README, skills, and settings.json enabledPlugins entry. Related to #299 https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * chore: `mise run lint` * chore: auto-bump plugin versions and update marketplace * docs: improve 1pass secrets configuration documentation Add detailed explanation of the secrets `target` field with a comparison table, usage guidance for each target, and a multi-target example in the README. Add valid target values as comments in the project-level plugins.settings.yaml. https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * chore: `mise run lint` * chore: format settings.json deny array https://claude.ai/code/session_015AHLh1tFE1RGsYXH7WvKr1 * fix: validate and fix 1pass secrets injection (#309) * fix: yq compatibility in plugin_get_config_json and correct vault reference Two bugs prevented 1pass secrets injection from working: 1. _plugin_read_config_json used `yq -r -o=json` which is a mikefarah/yq (Go) flag. Python yq (jq wrapper) doesn't support -o=json and silently fails, causing inject_secrets to see 0 secrets. Fixed by falling back to `yq -r` when -o=json fails — Python yq outputs JSON by default. 2. The Braintrust secret reference used vault "heapsinfra" which the service account doesn't have access to. Changed to "AI-Jack" which is the vault available to the OP_SERVICE_ACCOUNT_TOKEN. Bumps 1pass plugin to 0.1.13. https://claude.ai/code/session_01Pr3ohqAFya5fPn3QXMq1Wy * chore: `mise run lint` --------- Co-authored-by: Claude <noreply@anthropic.com> * feat(1pass): add userSettingsJson target for secrets injection Adds a new `userSettingsJson` target that writes secrets to ~/.claude/settings.json env block. This is useful for API keys (like BRAINTRUST_API_KEY) that should be available across all projects for a user without being committed to any repo. Also updates the project config to use this target for the Braintrust API key. https://claude.ai/code/session_018VyV8FnFEME5cSQpJkxoJA * chore: `mise run lint` * chore: auto-bump plugin versions and update marketplace * fix(1pass): DRY up _write_secret() JSON settings cases Collapse settingsJson, settingsLocalJson, and userSettingsJson into a single case block — only the file path differs. Also fix doc comment to include userSettingsJson in the target list. Addresses review feedback on #310. https://claude.ai/code/session_018VyV8FnFEME5cSQpJkxoJA --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: automation-nsheaps[bot] <251779498+automation-nsheaps[bot]@users.noreply.github.com>
1 parent 637648e commit 0afe6c0

16 files changed

Lines changed: 330 additions & 29 deletions

File tree

‎.claude-plugin/marketplace.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
{
1212
"name": "1pass",
1313
"description": "Install and manage 1Password CLI (op) and op-exec in Claude Code sessions. Provides session-start auto-install for web sessions and comprehensive workflow skills.",
14-
"version": "0.1.11",
14+
"version": "0.2.0",
1515
"author": {
1616
"name": "Nathan Heaps"
1717
},
@@ -68,7 +68,7 @@
6868
{
6969
"name": "common-sense",
7070
"description": "Common-sense rules for AI assistant behavior. On session start, symlinks bundled rules into the project's .claude/rules/common-sense directory so they are automatically loaded as context.",
71-
"version": "1.3.12",
71+
"version": "1.3.13",
7272
"author": {
7373
"name": "Nathan Heaps"
7474
},
@@ -194,7 +194,7 @@
194194
{
195195
"name": "git-spice",
196196
"description": "Skill for managing stacked Git branches with git-spice (gs) CLI tool",
197-
"version": "0.2.6",
197+
"version": "0.2.7",
198198
"author": {
199199
"name": "Nathan Heaps"
200200
},
@@ -214,7 +214,7 @@
214214
{
215215
"name": "github",
216216
"description": "GitHub CLI installation, authentication, and workflow skill for Claude Code sessions. Consolidates gh-tool and github-auth-skill into a single plugin.",
217-
"version": "0.1.12",
217+
"version": "0.1.13",
218218
"author": {
219219
"name": "Nathan Heaps"
220220
},
@@ -239,7 +239,7 @@
239239
{
240240
"name": "github-app",
241241
"description": "Automatic GitHub App token lifecycle for Claude Code sessions. Generates installation tokens on session start, monitors expiry via PreToolUse hook, and refreshes transparently before commands that need authentication.",
242-
"version": "0.1.10",
242+
"version": "0.1.11",
243243
"author": {
244244
"name": "Nathan Heaps"
245245
},
@@ -261,7 +261,7 @@
261261
{
262262
"name": "google-workspace-cli",
263263
"description": "Install and manage the Google Workspace CLI (gws) with per-service skills for Gmail, Calendar, Drive, Docs, Sheets, Slides, Chat, Tasks, Contacts, and Admin",
264-
"version": "0.1.6",
264+
"version": "0.1.7",
265265
"author": {
266266
"name": "Nathan Heaps"
267267
},
@@ -313,7 +313,7 @@
313313
{
314314
"name": "mise",
315315
"description": "Install and manage mise (tool version manager) in Claude Code sessions. Provides session-start auto-install for web sessions and comprehensive workflow skills.",
316-
"version": "0.2.17",
316+
"version": "0.2.18",
317317
"author": {
318318
"name": "Nathan Heaps"
319319
},
@@ -353,7 +353,7 @@
353353
{
354354
"name": "permissions-sync",
355355
"description": "Merge permission scopes from configurable source settings.json files into settings.local.json on session start. Supports project-level and user-level installation.",
356-
"version": "0.1.11",
356+
"version": "0.1.12",
357357
"author": {
358358
"name": "Nathan Heaps"
359359
},
@@ -478,7 +478,7 @@
478478
{
479479
"name": "sequential-thinking",
480480
"description": "Set up the sequential-thinking MCP server and auto-configure permissions for its tools on session start.",
481-
"version": "0.1.10",
481+
"version": "0.1.11",
482482
"author": {
483483
"name": "Nathan Heaps"
484484
},

‎.claude/plugins.settings.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ github:
1010
github-app:
1111
# Fetch all GitHub App secrets from a single 1Password item.
1212
# Uses bin/op-exec to render item fields as environment variables.
13-
ref: 'op://heapsinfra/github-app--repo--ai-mktpl'
13+
ref: 'op://AI-Jack/github-app--repo--ai-mktpl'
1414
# Item fields expected:
1515
# GITHUB_APP_ID
1616
# GITHUB_APP_CLIENT_ID
@@ -23,3 +23,21 @@ mise:
2323

2424
edit-utils:
2525
formatter: 'prettier --write'
26+
27+
1pass:
28+
enabled: true
29+
autoInstall: false
30+
# Inject 1Password secrets as environment variables at session start.
31+
# Requires OP_SERVICE_ACCOUNT_TOKEN to be set (e.g. via settings.local.json env block),
32+
# or op to be signed in interactively on local sessions.
33+
#
34+
# Each entry: envVar (required), reference (required), target (optional, default: envFile)
35+
# Valid targets:
36+
# envFile — write to CLAUDE_ENV_FILE (session-scoped, not persisted, recommended)
37+
# settingsLocalJson — write to .claude/settings.local.json env block (persists, gitignored)
38+
# settingsJson — write to .claude/settings.json env block (persists, COMMITTED to git)
39+
# userSettingsJson — write to ~/.claude/settings.json env block (user-global, not committed)
40+
secrets:
41+
- envVar: BRAINTRUST_API_KEY
42+
reference: 'op://AI-Jack/Braintrust/api-key'
43+
target: userSettingsJson

‎.claude/settings.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@
113113
]
114114
},
115115
"enabledPlugins": {
116+
"trace-claude-code@braintrust-claude-plugin": true,
116117
"agent-sdk-dev@claude-plugins-official": false,
117118
"code-review@claude-plugins-official": false,
118119
"plugin-dev@claude-plugins-official": true,
@@ -142,6 +143,12 @@
142143
"source": "github",
143144
"repo": "nsheaps/ai-mktpl"
144145
}
146+
},
147+
"braintrust-claude-plugin": {
148+
"source": {
149+
"source": "github",
150+
"repo": "braintrustdata/braintrust-claude-plugin"
151+
}
145152
}
146153
}
147154
}

‎plugins/1pass/.claude-plugin/plugin.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "1pass",
3-
"version": "0.1.11",
3+
"version": "0.2.0",
44
"description": "Install and manage 1Password CLI (op) and op-exec in Claude Code sessions. Provides session-start auto-install for web sessions and comprehensive workflow skills.",
55
"author": {
66
"name": "Nathan Heaps",

‎plugins/1pass/1pass.settings.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,26 @@
3131
# Specific op-exec version to install (default: latest)
3232
# opExecVersion: "1.0.0"
3333
opExecVersion: 'latest'
34+
35+
# Inject 1Password secrets as environment variables at session start.
36+
# Requires op to be available and authenticated (OP_SERVICE_ACCOUNT_TOKEN set,
37+
# or op signed in interactively on local sessions).
38+
#
39+
# Each entry has:
40+
# envVar: (required) Environment variable name to set
41+
# reference: (required) 1Password secret reference (op://vault/item/field)
42+
# target: (optional) Where to write the variable. One of:
43+
# envFile — append to CLAUDE_ENV_FILE (session-scoped, default)
44+
# settingsJson — write to .claude/settings.json env block (committed)
45+
# settingsLocalJson — write to .claude/settings.local.json env block (gitignored)
46+
# userSettingsJson — write to ~/.claude/settings.json env block (user-global, not committed)
47+
#
48+
# Example:
49+
# secrets:
50+
# - envVar: BRAINTRUST_API_KEY
51+
# reference: "op://Personal/Braintrust/api-key"
52+
# target: envFile
53+
# - envVar: ANTHROPIC_API_KEY
54+
# reference: "op://Work/Claude API Key/credential"
55+
# target: envFile
56+
secrets: []

‎plugins/1pass/README.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,64 @@ Create or update `plugins.settings.yaml` at project or user level:
4040
opExecVersion: "latest" # Pin a specific op-exec version or use "latest"
4141
```
4242
43+
## Secrets Injection
44+
45+
The plugin can inject 1Password secrets as environment variables at session start. This works on **all session types** (local and web), as long as `op` is available and authenticated.
46+
47+
### Secrets Configuration
48+
49+
Each secret entry has three fields:
50+
51+
| Field | Required | Description |
52+
| ----------- | -------- | ------------------------------------------------------------ |
53+
| `envVar` | yes | Environment variable name to set (e.g. `BRAINTRUST_API_KEY`) |
54+
| `reference` | yes | 1Password secret reference in `op://vault/item/field` format |
55+
| `target` | no | Where to write the variable (default: `envFile`) |
56+
57+
### Target Options
58+
59+
The `target` field controls where the resolved secret value is persisted:
60+
61+
| Target | File written | Scope | Committed to git? |
62+
| ------------------- | ------------------------------------------- | ------------------------------------------- | --------------------------------- |
63+
| `envFile` (default) | `$CLAUDE_ENV_FILE` | Current session only — gone on next session | No |
64+
| `settingsJson` | `.claude/settings.json` → `env` block | Persists across sessions | **Yes** — visible in repo history |
65+
| `settingsLocalJson` | `.claude/settings.local.json` → `env` block | Persists across sessions | No — gitignored |
66+
| `userSettingsJson` | `~/.claude/settings.json` → `env` block | User-global, persists across all projects | No — outside repo |
67+
68+
**When to use which target:**
69+
70+
- **`envFile`** — Best for most secrets. Session-scoped, no disk persistence, no git risk. Re-injected fresh each session from 1Password. This is the default and recommended target.
71+
- **`settingsLocalJson`** — Use when you need the secret to survive across sessions without re-injection (e.g. if `op` auth is only available during initial setup). The file is gitignored so secrets won't leak to the repo.
72+
- **`userSettingsJson`** — Use for secrets that should be available across all projects for a user. Writes to `~/.claude/settings.json` which is outside any repo. Good for API keys used across multiple projects (e.g. `BRAINTRUST_API_KEY`).
73+
- **`settingsJson`** — Use only for non-sensitive values you want committed. **Never use this for actual secrets** — the file is tracked by git.
74+
75+
### Example
76+
77+
```yaml
78+
1pass:
79+
enabled: true
80+
secrets:
81+
# API key re-injected each session (recommended)
82+
- envVar: BRAINTRUST_API_KEY
83+
reference: "op://Personal/Braintrust/api-key"
84+
target: envFile
85+
86+
# Persists locally between sessions (gitignored)
87+
- envVar: DATABASE_URL
88+
reference: "op://Work/Production DB/connection_string"
89+
target: settingsLocalJson
90+
91+
# Non-secret config value committed to repo
92+
- envVar: SENTRY_ORG
93+
reference: "op://Work/Sentry/org-slug"
94+
target: settingsJson
95+
96+
# target defaults to envFile when omitted
97+
- envVar: ANTHROPIC_API_KEY
98+
reference: "op://Work/Claude API Key/credential"
99+
```
100+
43101
## Authentication
44102

45103
The op CLI requires authentication. Options:

0 commit comments

Comments
 (0)
⚡