c1fa9c0025
Extension tests for the browser Chrome internals, the Codex app-server transport, the 1Password secret-ref resolver, the QA Lab model catalog runtime, and the QA Lab test-file scenario command lifecycle polled marker and PID files against wall-clock deadlines, so a fixture child that outlasted the bound on a loaded host failed the test. Waits now await fixture-owned readiness: owned stdout or IPC where the test spawns the child, and fixture receipts with a durable-record fallback where the product owns it. Extensions get the shared helpers (withinTest, awaitGateBeforeSettlement, openFixtureReceiptChannel, fixtureReceiptClientSource) through the local-only openclaw/plugin-sdk/test-fixtures facade, which is excluded from dist, instead of importing test/helpers or keeping per-plugin copies. The lifecycle test signals the retained leader with SIGTERM and awaits the existing command lifecycle's graceful cleanup, joining the same memoized cleanup from finally and onTestFinished because Vitest otherwise abandons a timed-out body before its async cleanup finishes. QA Lab drops its now-unused file/PID polling helpers. No product source, public SDK export, test timeout, product timeout, or assertion meaning changed. Part of the polling audit from #162274. Proof on Blacksmith Testbox: delay probes fail the original bytes and pass these bytes, the forced-abort probe reproduces the leak before the cleanup join and finds no survivors after it, 100/100 then 50/50 standalone runs of the changed files, 7/7 owning extension bundles, qa-lab bundle (242 files, 2,656 tests), extension test boundary, plugin SDK subpath/broad-entry/core-import lints, deadcode, OpenGrep, extension tsgo, type-aware lint, base-aware timeout-race ratchet; Codex autoreview and ClawSweeper clean. |
||
|---|---|---|
| .. | ||
| assets | ||
| src | ||
| index.test.ts | ||
| index.ts | ||
| index.worker.test.ts | ||
| onepassword-op-path.d.ts | ||
| onepassword-op-path.js | ||
| onepassword-secret-id.d.ts | ||
| onepassword-secret-id.js | ||
| onepassword-secret-ref-resolver.js | ||
| openclaw.plugin.json | ||
| package.json | ||
| README.md | ||
@openclaw/onepassword
Resolve OpenClaw SecretRefs from 1Password and give agents access to a curated set of secrets with approval policy and audit history.
The plugin is also included in OpenClaw. It uses the official op CLI and a
1Password service account on the Gateway host. Follow the
1Password plugin guide to prepare
the CLI, token file, SecretRefs, and optional agent registry.
The SecretRef integration and agent tool are separate, opt-in surfaces. Enabling the plugin alone does not expose the tool: the agent registry must also name the permitted items. Each registered item can allow access, require approval, or deny access; approval is the default policy.
Keep the service-account token in the credentials file described by the guide, not in plugin configuration. Scope the service account to the required items. Requested secret values are visible to the model for that execution; the plugin redacts its own persisted tool result but cannot prevent the model from copying a value into later output. Keep access reasons non-sensitive because they are recorded in the audit history.
openclaw onepassword status reports local readiness without fetching a secret.
openclaw onepassword audit shows recent access outcomes. Installation does
not create a service account or grant access to a vault.