From e1fda44ecc91610089962364dfaa5ff1d0ce2add Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Thu, 16 Jul 2026 04:52:36 -0700
Subject: [PATCH] fix(onepassword): preserve oversized token diagnostics
 (#108964)

---
 extensions/onepassword/src/op-client.test.ts | 2 +-
 extensions/onepassword/src/op-client.ts      | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/extensions/onepassword/src/op-client.test.ts b/extensions/onepassword/src/op-client.test.ts
index 5b7f335c8d1f..ec65942e13ed 100644
--- a/extensions/onepassword/src/op-client.test.ts
+++ b/extensions/onepassword/src/op-client.test.ts
@@ -127,7 +127,7 @@ describe("OpClient", () => {
       client.getItem({ item: "Token", vault: "Automation", field: "credential" }),
     ).rejects.toMatchObject({
       code: "TOKEN_MISSING",
-      message: "1Password service account token file is too large",
+      message: `1Password service account token file at ${tokenFile} exceeds 16384 bytes.`,
     });
     expect(runner).not.toHaveBeenCalled();
   });
diff --git a/extensions/onepassword/src/op-client.ts b/extensions/onepassword/src/op-client.ts
index 31e2f418f7ba..aefd25d4c6fa 100644
--- a/extensions/onepassword/src/op-client.ts
+++ b/extensions/onepassword/src/op-client.ts
@@ -2,9 +2,9 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { runExec } from "openclaw/plugin-sdk/process-runtime";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
-import { FsSafeError } from "openclaw/plugin-sdk/security-runtime";
 import { OnePasswordError } from "./errors.js";
 
 const MAX_STDOUT_BYTES = 1024 * 1024;
@@ -208,8 +208,8 @@ export class OpClient {
       }
     } catch (error) {
       const message =
-        error instanceof FsSafeError && error.code === "too-large"
-          ? "1Password service account token file is too large"
+        error instanceof Error && extractErrorCode(error) === "too-large"
+          ? error.message
           : "1Password service account token file is missing";
       throw new OnePasswordError("TOKEN_MISSING", message, { cause: error });
     }