1passwordlisted

# 1Password CLI -- Secure Access Patterns ## Resolving Credentials from Private Links When a credential is needed, ask the user for the item's **private link** (copied from 1Password: right-click item > "Copy Private Link") and the **field name(s)** to read. A private link has the format: ``` https://start.1password.com/open/i?a=<ACCOUNT>&v=<VAULT>&i=<ITEM>&h=<DOMAIN> ``` Extract the URL parameters to construct the `op read` command: | Parameter | Maps To | |-----------|-------------------------| | `a` | `--account` value | | `v` | vault in `op://` path | | `i` | item in `op://` path | The `h` parameter (account domain) is informational only -- use `a` for `--account`. The resulting command: ```sh op read --account <a> -n "op://<v>/<i>/<field>" ``` Example -- given link `https://start.1password.com/open/i?a=ABC123&v=xyz789&i=item456&h=acme.1password.com` and field `password`: ```sh op read --account ABC123 -n "op://xyz789/item456/password" ``` ## Security Rules (mandatory, no exceptions) 1. Never echo, print, log, or assign a secret to a variable that appears in command output visible to Claude. 2. Never use `op read` in a command substitution that Claude can observe (e.g., `echo $(op read ...)`). 3. Never store secrets in environment variables set before a Bash tool call. 4. Never include secrets in conversation text, commit messages, file contents, or logs. 5. If `op read` fails, report the error category (auth, miss