{
  "id": "onepassword",
  "name": "1Password",
  "description": "1Password SecretRef resolver and curated agent broker with approval policy and SQLite audit history.",
  "activation": {
    "onStartup": false,
    "onCommands": ["onepassword"],
    "onConfigPaths": ["plugins.entries.onepassword.config"]
  },
  "commandAliases": [
    {
      "name": "onepassword",
      "cliCommand": "onepassword"
    }
  ],
  "contracts": {
    "tools": ["onepassword"]
  },
  "secretProviderIntegrations": {
    "onepassword": {
      "providerAlias": "onepassword",
      "displayName": "1Password",
      "description": "Resolve OpenClaw exec SecretRefs from 1Password using the op CLI.",
      "source": "exec",
      "command": "${node}",
      "args": ["./onepassword-secret-ref-resolver.js"],
      "timeoutMs": 90000,
      "noOutputTimeoutMs": 90000,
      "maxOutputBytes": 16777216,
      "passEnv": [
        "HOME",
        "USERPROFILE",
        "HOMEDRIVE",
        "HOMEPATH",
        "APPDATA",
        "LOCALAPPDATA",
        "TEMP",
        "TMP",
        "OPENCLAW_HOME",
        "OPENCLAW_PROFILE",
        "OPENCLAW_STATE_DIR",
        "PATH",
        "CLAW_1PASSWORD_OP",
        "SYSTEMROOT",
        "WINDIR"
      ]
    }
  },
  "configSchema": {
    "type": "object",
    "additionalProperties": false,
    "allOf": [
      {
        "if": { "required": ["vault"] },
        "then": { "required": ["items"] }
      },
      {
        "if": { "required": ["items"] },
        "then": { "required": ["vault"] }
      }
    ],
    "properties": {
      "vault": {
        "type": "string",
        "minLength": 1,
        "pattern": "^(?!\\s*-)"
      },
      "opBin": {
        "type": "string",
        "minLength": 1
      },
      "defaultPolicy": {
        "type": "string",
        "enum": ["auto", "approve", "deny"],
        "default": "approve"
      },
      "cacheTtlSeconds": {
        "type": "integer",
        "minimum": 0,
        "default": 300
      },
      "grantTtlHours": {
        "type": "number",
        "exclusiveMinimum": 0,
        "default": 720
      },
      "opTimeoutMs": {
        "type": "integer",
        "minimum": 1,
        "default": 15000
      },
      "items": {
        "type": "object",
        "minProperties": 1,
        "maxProperties": 32,
        "propertyNames": {
          "pattern": "^[a-z0-9][a-z0-9-]{0,63}$"
        },
        "additionalProperties": {
          "type": "object",
          "additionalProperties": false,
          "required": ["item"],
          "properties": {
            "item": {
              "type": "string",
              "minLength": 1,
              "pattern": "^(?!\\s*-)"
            },
            "vault": {
              "type": "string",
              "minLength": 1,
              "pattern": "^(?!\\s*-)"
            },
            "field": {
              "type": "string",
              "minLength": 1,
              "pattern": "^[^,]+$",
              "default": "credential"
            },
            "policy": {
              "type": "string",
              "enum": ["auto", "approve", "deny"]
            },
            "description": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          }
        }
      }
    }
  }
}