1password

# 1Password CLI Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files. ## Requirements - 1Password account - 1Password CLI (`op`) installed - One of: desktop app integration, service account token (`OP_SERVICE_ACCOUNT_TOKEN`), or Connect server - `tmux` available for stable authenticated sessions during Hermes terminal calls (desktop app flow only) ## When to Use - Install or configure 1Password CLI - Sign in with `op signin` - Read secret references like `op://Vault/Item/field` - Inject secrets into config/templates using `op inject` - Run commands with secret env vars via `op run` ## Authentication Methods ### Service Account (recommended for Hermes) Set `OP_SERVICE_ACCOUNT_TOKEN` in `~/.hermes/.env` (the skill will prompt for this on first load). No desktop app needed. Supports `op read`, `op inject`, `op run`. ```bash export OP_SERVICE_ACCOUNT_TOKEN="your-token-here" op whoami # verify — should show Type: SERVICE_ACCOUNT ``` ### Desktop App Integration (interactive) 1. Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI 2. Ensure app is unlocked 3. Run `op signin` and approve the biometric prompt ### Connect Server (self-hosted) ```bash export OP_CONNECT_HOST="http://localhost:8080" export OP_CONNECT_TOKEN="your-connect-token" ``` ## Setup 1. Install CLI: ```bash # macOS brew install 1password-cli # Linux (official package/install docs) # See references/get-started.md ...