feat(platform): pluggable credential resolvers — remove the 1Password default

[jamaynor]

What

Every printed CLI currently ships a 1Password dependency whether or not its operator uses 1Password:

• platform_profile.go.tmpl emits an OnePasswordResolver that shells out to 1password-pp-cli secrets read --reveal
• ValidateCredentialReference rejects any reference not beginning with op://
• platform_cli.go.tmpl's platformResolverFactory returns that resolver as the only option

The CredentialResolver interface was already the right abstraction — it was just bypassed by a hardcoded validator and a single hardcoded implementation. This puts a registry behind it:

• RegisterCredentialResolver(scheme, resolver) — scheme and resolver register together, so a scheme the validator accepts but no resolver handles cannot exist
• ValidateCredentialReference is registry-driven; with nothing registered every reference is rejected with an error saying so
• RegistryResolver dispatches by scheme and is what the generated CLI uses; no vendor is privileged
• New spec field auth.credential_resolvers: [file|bitwarden|onepassword], defaulting to [file] — the one resolver that depends on nothing installed. 1Password remains available as an explicit opt-in
• Unknown resolver names are a spec validation error naming the catalog, not a silent skip

Notes for review

• CredentialScheme.Validate exists because a filesystem path is not a sequence of opaque identifiers: file:///etc/key splits to a leading empty component, so the generic component rules would reject every absolute path
• Test fixtures now come from a credentialRefFixture template function instead of hardcoded op:// strings — hardcoding one vendor's syntax in the test templates is part of how the original assumption stayed invisible
• Subprocess-backed resolvers share runCredentialCommand, which enforces: no credential value ever enters argv, and provider stderr never enters an error (a secret manager may echo the resolved value while reporting an unrelated failure)
• Second commit is an unrelated pre-existing fix: the read-only-dir save test fails under root (CAP_DAC_OVERRIDE bypasses the DAC check); it now skips as root, mirroring its existing Windows skip. Happy to split it out if preferred

Behaviour change

A reprint of a CLI that used op:// references rejects them unless its spec opts into onepassword. In practice nothing is affected today: registerPlatformSource is never called by any printed CLI, so this path is dead code everywhere — which is also why the hard dependency went unnoticed.

Verification

• internal/spec suite green including 9 new tests
• Full internal/generator suite run to completion (-timeout 45m): no failures attributable to this change (one pre-existing root-environment failure, fixed in the second commit)
• Three end-to-end prints of a real spec — default, [bitwarden, file], [onepassword] — each passing the generator's own build/vet/test/bundle gates; the default print contains zero 1Password references

🤖 Generated with Claude Code

[mergify]

Merge Protections

🔴 2 of 2 protections blocking · waiting on 👀 reviews, 🤖 CI and 🙋 you

	Protection	Waiting on
🔴	require-ready-label-and-ci	👀 reviews, 🤖 CI and 🙋 you
🔴	🚦 Auto-queue	🙋 you

🔴 require-ready-label-and-ci

Waiting for

• #review-threads-unresolved = 0
• check-success = build-and-test
• any of:
  • label = ready-to-merge
  • title ~= ^chore\(main\): release

This rule is failing.

• #review-threads-unresolved = 0
• check-success = build-and-test
• any of:
  • label = ready-to-merge
  • all of:
    • head = release-please--branches--main
    • title ~= ^chore\(main\): release
• #changes-requested-reviews-by = 0
• check-success = generated-test
• check-success = go-lint
• check-success = golden
• check-success = pr-title
• check-success = test
• any of:
  • -files ~= ^(\.github/workflows/|\.github/scripts/|scripts/|\.github/CODEOWNERS$)
  • approved-reviews-by = mvanhorn
  • approved-reviews-by = tmchow
  • author = mvanhorn
  • author = tmchow
• any of:
  • check-success = Greptile Review
  • check-neutral = Greptile Review
  • check-skipped = Greptile Review
  • head ~= ^mergify/merge-queue/
  • label = queued
  • all of:
    • head = release-please--branches--main
    • title ~= ^chore\(main\): release

🔴 🚦 Auto-queue

Waiting for

• label = ready-to-merge

This rule is failing.

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

• label = ready-to-merge

[greptile-apps]

File resolver mutates credentials

When a file-backed credential legitimately begins or ends with whitespace, strings.TrimSpace removes those significant bytes, causing the generated CLI to authenticate with a different value and reject an otherwise valid credential.

Suggested change

	// Surrounding whitespace is stripped so a file written with a trailing
	// newline — which every editor and every `echo` produces — works.
	value := strings.TrimSpace(string(data))
	if value == "" {
	return nil, fmt.Errorf("credential file %s is empty", path)
	}
	return []byte(value), nil
	// Remove one editor-added line ending without changing other credential
	// bytes, since leading or trailing whitespace may be significant.
	value := strings.TrimSuffix(string(data), "\n")
	value = strings.TrimSuffix(value, "\r")
	if value == "" {
	return nil, fmt.Errorf("credential file %s is empty", path)
	}
	return []byte(value), nil

[greptile-apps]

Greptile Summary

Adds spec-selectable credential resolvers and makes file-backed credentials the vendor-neutral default.

• Introduces registry-driven credential reference validation and dispatch in generated CLIs.
• Adds file, Bitwarden, and opt-in 1Password resolver templates plus shared subprocess handling.
• Adds resolver catalog validation and resolver-aware generated test fixtures.
• Documents auth.credential_resolvers and updates generated conformance tests.
• Skips a POSIX permission test when running as root.

Confidence Score: 3/5

The file resolver’s credential mutation should be fixed before merging because it can make valid file-backed credentials fail authentication.

The new default resolver applies strings.TrimSpace to credential contents, changing valid leading or trailing whitespace bytes before they reach the authentication path.

Files Needing Attention: internal/generator/templates/platform_resolver_file.go.tmpl

Important Files Changed

Filename	Overview
internal/generator/templates/platform_profile.go.tmpl	Replaces hardcoded 1Password validation and resolution with a synchronized scheme-and-resolver registry.
internal/generator/templates/platform_resolver_file.go.tmpl	Adds the default file resolver, but its blanket whitespace trimming can alter valid credential values.
internal/generator/templates/platform_resolver_bitwarden.go.tmpl	Adds ID-based and project/key-based Bitwarden Secrets Manager resolution with duplicate-key rejection.
internal/generator/templates/platform_resolver_onepassword.go.tmpl	Moves 1Password support into an explicitly selected resolver template.
internal/spec/credential_resolvers.go	Defines the resolver catalog, default selection, template mapping, validation, and synthetic fixture references.
internal/generator/generator.go	Emits only the credential resolver templates selected by the effective auth configuration.
internal/spec/spec.go	Adds the resolver selection field to AuthConfig and validates catalog names during spec validation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    S[auth.credential_resolvers] --> T[Selected resolver templates]
    T --> I[Resolver init registration]
    R[Credential reference] --> V[Registry validation]
    V --> D[RegistryResolver dispatch]
    I --> V
    D --> F[File resolver]
    D --> B[Bitwarden resolver]
    D --> O[1Password resolver]
    F --> C[Resolved credential bytes]
    B --> C
    O --> C

Loading

_{Reviews (1): Last reviewed commit: "test(generator): skip the read-only-dir ..." | Re-trigger Greptile}