This repository was archived by the owner on Sep 8, 2026. It is now read-only.

feat: Add 1Password Secrets Manager integration for gateway credential bootstrap - #127

Merged

github-actions[bot] merged 31 commits into

mainfrom

claude/slack-session-94aae0

Aug 1, 2026

Commits on Aug 1, 2026

Add 1Password Secrets Manager integration following Bitwarden pattern
claude
committed
09ce639
fix: resolve type checker warnings for optional onepassword-sdk import
claude
committed
91fed10
fix: resolve CodeQL security alerts - redact secrets from logs, use stronger hash for cache key
claude
committed
7d45b25
fix: remove token from cache key to resolve CodeQL hash-on-sensitive-data alert
claude
committed
9496d90
fix: restore bitwarden early-return structure to avoid CodeQL reanalysis, redact exception from 1password error log
claude
committed
fb6fa6b
fix: redact secret names and error details from Bitwarden status prints
claude
committed
08ed4f2
fix: resolve final CodeQL alert - redact exception message from 1Password warning log
claude
committed
961b671
fix: eliminate all remaining token taint paths to logging sinks
claude
committed
650ef65
fix: suppress exception chains and exc_info to eliminate all CodeQL taint paths
claude
committed
5b2171d
fix: redact exception details in 1Password CLI commands to resolve final CodeQL alert
claude
committed
91552a7
fix: remove secret key names from debug log to cut last CodeQL taint path
claude
committed
ec8bc94
chore: clarify SDK auto-install exception is safe to log in full
claude
committed
f52ceef
ci: retrigger CodeQL after GitHub 503 transient error
claude
committed
4b40796
fix: do not store 1Password service account token in plaintext .env file
claude
committed
c3046bf
Add official MCP memory server to project settings
claude
committed
7c2d45a
fix: update nix lockfile hashes for tui and web packages
claude
committed
88e64c7
ci: retrigger nix build
claude
committed
711f7b7
fix: address Codex review - asyncio event loop, timeouts, config defaults, and UX fixes
claude
committed
02850fa
fix: revert bitwarden error display to avoid CodeQL taint (use safe message)
claude
committed
4640dac
fix: remove tainted logger.debug to pass CodeQL
claude
committed
1dad0a8
fix: correct DEFAULT_CONFIG keys, use sys.executable for pip, detect field collisions, enable secret rotation
claude
committed
b8d858c
fix: honor lazy install gate and remove service account token from argv
claude
committed
3738af0
fix: use main branch nix lockfile hashes after rebase
claude
committed
6859cd7
fix: use repo pip install strategy for uv virtualenv compatibility
claude
committed
0081f47
fix: use correct SDK list_all() methods and narrow pre-1.0 version ceiling
claude
committed
2204815
chore: update uv.lock for onepassword-sdk optional dependency
claude
committed
f53cb84
fix: allow explicit 'hermes secrets onepassword install' to bypass lazy-install gate
claude
committed
8d9c24d
ci: retrigger CodeQL after GitHub 503 transient error
claude
committed
4e2a6b6
ci: retrigger nix build
claude
committed
255ef64
fix: address remaining Codex review findings on 1Password integration
claude
committed
6ed1655
fix: block dangerous process-control env vars and register OP_SERVICE_ACCOUNT_TOKEN
claude
committed
aa97ed1

Navigation Menu

feat: Add 1Password Secrets Manager integration for gateway credential bootstrap - #127

feat: Add 1Password Secrets Manager integration for gateway credential bootstrap#127
github-actions[bot] merged 31 commits into
mainfrom
claude/slack-session-94aae0

Commits on Aug 1, 2026

Add 1Password Secrets Manager integration following Bitwarden pattern

fix: resolve type checker warnings for optional onepassword-sdk import

fix: resolve CodeQL security alerts - redact secrets from logs, use stronger hash for cache key

fix: remove token from cache key to resolve CodeQL hash-on-sensitive-data alert

fix: restore bitwarden early-return structure to avoid CodeQL reanalysis, redact exception from 1password error log

fix: redact secret names and error details from Bitwarden status prints

fix: resolve final CodeQL alert - redact exception message from 1Password warning log

fix: eliminate all remaining token taint paths to logging sinks

fix: suppress exception chains and exc_info to eliminate all CodeQL taint paths

fix: redact exception details in 1Password CLI commands to resolve final CodeQL alert

fix: remove secret key names from debug log to cut last CodeQL taint path

chore: clarify SDK auto-install exception is safe to log in full

ci: retrigger CodeQL after GitHub 503 transient error

fix: do not store 1Password service account token in plaintext .env file

Add official MCP memory server to project settings

fix: update nix lockfile hashes for tui and web packages

ci: retrigger nix build

fix: address Codex review - asyncio event loop, timeouts, config defaults, and UX fixes

fix: revert bitwarden error display to avoid CodeQL taint (use safe message)

fix: remove tainted logger.debug to pass CodeQL

fix: correct DEFAULT_CONFIG keys, use sys.executable for pip, detect field collisions, enable secret rotation

fix: honor lazy install gate and remove service account token from argv

fix: use main branch nix lockfile hashes after rebase

fix: use repo pip install strategy for uv virtualenv compatibility

fix: use correct SDK list_all() methods and narrow pre-1.0 version ceiling

chore: update uv.lock for onepassword-sdk optional dependency

fix: allow explicit 'hermes secrets onepassword install' to bypass lazy-install gate

ci: retrigger CodeQL after GitHub 503 transient error

ci: retrigger nix build

fix: address remaining Codex review findings on 1Password integration

fix: block dangerous process-control env vars and register OP_SERVICE_ACCOUNT_TOKEN