pi-op

1Password extension for Pi. macOS only.

Gives the agent access to 1Password secrets without ever exposing plaintext values. The agent can browse vaults, load secrets into the session environment, and run programs that use them — but never sees the actual secret values.

Why not the op CLI?

The op CLI works, but it has problems as an agent tool:

• Too much surface area. The CLI can create, update, delete vaults and items. The agent only needs to read.
• Shell injection risk. Shelling out to op with dynamic arguments is a vector. The SDK uses typed function calls.
• Auth friction. The CLI uses interactive sessions or biometric prompts. The SDK uses a service account token — headless, no prompts.
• Secrets in tool output. op read returns plaintext to stdout, which goes straight back to the agent. This extension injects secrets into process.env and redacts any leaked values from all tool output.
• No redaction layer. The CLI has no concept of preventing the caller from seeing what it returns. This extension intercepts every tool result (bash, read, grep, etc.) and replaces known secret values with [REDACTED].
• Slower. Every op invocation spawns a process. The SDK initializes once and resolves secrets via WASM in-process.

How it works

1. A 1Password service account token is stored in the macOS Keychain (Secure Enclave-backed, never touches disk as plaintext).
2. On startup, the extension pulls the token from Keychain and initializes the 1Password SDK.
3. op_load resolves op:// secret references via the SDK and injects them into process.env.
4. All subsequent bash calls inherit the secrets as regular environment variables.
5. A global tool_result hook scans every tool's output for known secret values and replaces them with [REDACTED].
6. On session switch or shutdown, secrets are cleared from process.env.

Child processes (including nested Pi instances) automatically inherit the redaction map via __OP_LOADED_REFS — a JSON env var containing only the op:// reference metadata (not values). Any child Pi with this extension re-resolves the refs on startup and rebuilds its own redaction map.

Setup

1. Create a 1Password service account

Go to your 1Password account settings and create a service account with read access to the vaults you need. Copy the token.

2. Store the token in macOS Keychain

read -rs OP_TOKEN
# paste token, press enter
security add-generic-password -a "$USER" -s op-service-account -U -w "$OP_TOKEN"
unset OP_TOKEN

The token is now in Keychain, backed by Secure Enclave on Apple Silicon. No plaintext on disk, not in shell history.

3. Install the extension

# install dependencies
cd path/to/pi-op
npm install

# symlink into Pi's global extensions directory
ln -s "$(pwd)" ~/.pi/agent/extensions/op

4. Verify

Start Pi. You should see 1P: ready in the footer. Ask the agent to list your vaults:

list my 1password vaults

Tools

op_list

Browse vaults and items. Metadata only — never returns secret values.

• No params: list all vaults
• vault: list items in a vault (by name or ID)
• vault + item: show item field structure (field names, types, op:// refs — no values)

op_load

Resolve op:// references and inject into the session environment.

• Values starting with op:// are resolved from 1Password
• Plain values pass through as-is
• Resolved values are set on process.env — all bash calls inherit them
• All tool output is scanned for leaked values and redacted

Security model

What the agent can see:

• Vault names, item names, field names/types (metadata)
• op:// reference URIs
• Command output with secret values replaced by [REDACTED]

What the agent cannot see:

• Resolved secret values (injected directly into process.env, redacted from all output)

Known limitations:

• Secrets shorter than 4 characters are not redacted (too many false positives)
• Encoding transforms (base64, hex, reverse) bypass exact-match redaction

Requirements

• macOS (uses security CLI for Keychain access)
• Node.js or Bun
• Pi
• 1Password service account with vault read access