Resolve 1Password Secret Reference via the 1Password SDK

[JillRegan]

Summary

This PR adds 1Password support to the Sandbox SDK and CLI. You pass 1Password secret references (op://vault/item/field) in integrations.onePassword.secrets when creating or getting a sandbox. The SDK resolves them client-side with the 1Password SDK (using a service account token or the desktop app) and injects the resolved values into the environment for every runCommand call. The CLI’s exec command also supports op:// refs in --env, so you can run commands with secrets resolved from 1Password without putting them in your shell environment.

Changes

SDK

• New integrations.onePassword.secrets option on Sandbox.create() and Sandbox.get(): a map of env var names to op:// refs.
• Refs are resolved client-side with the 1Password JavaScript SDK at create/get time. Resolved values are merged into the env for each runCommand.

CLI

• sandbox exec with --env accepts values that are op:// refs. They are resolved before the command runs (-env API_KEY=op://Vault/Item/field).

Example

• examples/onepassword-secrets: creates a sandbox with a secret from 1Password and runs a command that uses it. This is a minimal demo to show the flow. We're open to feedback from Vercel's team on example structure or additional examples.

Documentation updates

• Root README and packages/vercel-sandbox/README.md: 1Password section with integrations.onePassword.secrets, service account vs desktop app, Vercel (link env to project), and local setup.
• examples/onepassword-secrets/README.md: Prerequisites, how to run, troubleshooting.
• examples/README.md: 1Password example listed and described.

How it works

1. Caller passes integrations: { onePassword: { secrets: { MY_VAR: "op://Vault/Item/field" } } } to Sandbox.create() or Sandbox.get().
2. SDK uses OP_SERVICE_ACCOUNT_TOKEN (or OP_ACCOUNT for desktop) to call the 1Password SDK and resolve each ref.
3. Resolved values are stored as default env on the sandbox instance and merged into env for every runCommand().

How to test

Prerequisites

• A 1Password vault item with a field you can reference (op://My Vault/My Item/credential).
• A 1Password service account with access to that vault (or the 1Password desktop app with the Developer setting enabled for OP_ACCOUNT). See https://developer.1password.com/docs/sdks/ for more info.

Run the onepassword-secrets example

From repo root runpnpm build thenexamples/onepassword-secrets and pnpm install

Create .env.local with:
OP_SERVICE_ACCOUNT_TOKEN=
OP_REF=op://Your Vault/Your Item/field name

Run:
pnpm start
You should see output indicating the secret is set (e.g. MY_SECRET is set: yes and a non-zero length). If you see length 0, check OP_REF and token/vault access.

CLI exec with op refs

Create a sandbox ensure the 1Password token is available (export OP_SERVICE_ACCOUNT_TOKEN=... or run with --env-file .env.local). Run:
sandbox exec <sandbox-id> --env API_KEY=op://Vault/Item/field -- echo '$API_KEY'

[vercel]

@JillRegan is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​22.19.11
	npm/​@​1password/​sdk@​0.4.0

View full report