1Password: multiple named accounts

[RhysSullivan]

Builds on #1829 and resolves #1791. Reworks #1836 — co-authored with @Adityakk9031.

The 1Password provider now holds any number of named accounts. Each account has its own auth (desktop-app biometrics or a service-account token) and its own set of vaults. This separates work and personal credentials without one configuration overwriting the other.

Model

• Stored config is { accounts: [{ id, name, auth, vaults }] }. Both older shapes (single vaultId, and single-account multi-vault) normalize onto one default account on read; the next save writes the current shape. Item ids (op://<vaultId>/<itemId>) are unchanged, so existing picks keep resolving.
• op:// refs keep vault-first addressing, matching 1Password's own URI semantics. Vault ids are globally unique, so an id-qualified ref routes to whichever account owns the vault. A vault name that exists in more than one account is an explicit ambiguity error, as is a bare item ref matching several vaults — never a silent pick.
• Each account gets its own backend client, so a service-account token can never leak into another account's calls. One unreachable account no longer hides other accounts' items in the picker, and status reports per account.

API / tools

• configure upserts one account (no id = create, id = replace in place) and returns the account id.
• removeConfig removes one account by id, or everything without an id. Removing the last account deletes the config.
• getConfig returns the redacted account list; tokens are never surfaced.

UI

• The Providers page lists one card per account with independent Edit and Disconnect, plus "+ Add 1Password account".
• The add/edit dialog keeps the multi-select vault checkboxes and stale-while-revalidate vault loading.
• The item picker groups entries as Account · Vault when more than one account exists, vault name only otherwise.

Demo (synthetic data)

Two accounts, each with its own vault set:

Add dialog with multi-select vaults:

Item picker disambiguating identical titles across accounts:

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	b7c8cfe	Aug 29 2026, 07:06 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	b7c8cfe	Commit Preview URL Branch Preview URL	Aug 29 2026, 07:07 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1841

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1841

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1841

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1841

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1841

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1841

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1841

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1841

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1841

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1841

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1841

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1841

executor

npm i https://pkg.pr.new/executor@1841

commit: b7c8cfe