/op-secret-template

Given an item identifier, print every field on the item as a KEY=op://... line, suitable for a .env template used with op run --env-file=.env -- ....

Inputs

$ARGUMENTS — first arg is the item name or ID. Optionally --vault <vault> to scope the lookup.

Steps

1. Fetch the item as JSON:

   op item get $ARGUMENTS --format=json

1. From the JSON, extract:

• vault.name (call this VAULT)
• title (call this ITEM)
• For each entry in fields[]:
• label (or id if no label)
• section.label if section is present
• purpose (PASSWORD, USERNAME, NOTES, etc.) if no label
• type (STRING, CONCEALED, URL, EMAIL, OTP, DATE, MONTH_YEAR, PHONE)

1. Emit KEY=op://VAULT/ITEM[/SECTION]/FIELD_LABEL lines:

• Skip fields with no value AND no label (CLI metadata).
• Use the human-readable label for the secret reference.
• Convert each label to a SCREAMING_SNAKE env var name on the left side.
• For OTP fields, append ?attribute=otp so it returns the current code.
• For SSH private-key fields, append ?ssh-format=openssh.

1. Wrap output in a fenced block with a header explaining usage:

   # Generated for item "ITEM" in vault "VAULT"
   # Use with: op run --env-file=.env -- <command>
   USERNAME=op://VAULT/ITEM/username
   PASSWORD=op://VAULT/ITEM/password
   API_KEY=op://VAULT/ITEM/Credentials/api_key
   TOTP=op://VAULT/ITEM/totp?attribute=otp

1. Note any field type that needs special handling (file attachments → op read --out-file ... not env, document attachments not supported).

Edge cases

• Multiple sections with same field name → include the section name in the reference so the URI is unambiguous.
• Whitespace in vault/item/field names → wrap the whole reference value in single quotes in the output: KEY='op://Acme Prod/My Item/api key'.
• Special characters that secret refs don't allow → use the field's id instead of label, and note "(using ID instead of name due to special characters)".
• Item is a Document or has file attachments → emit a comment line explaining op read --out-file is needed instead of env loading.

On failure

• Item not found → suggest /op-find <query> to locate it.
• Multiple matches (interactive only error) → tell the user to disambiguate by ID or --vault.