Migrate secrets from .env to 1Password CLI

.claude-plugin/marketplace.json

@@ -6,15 +6,15 @@
   },
   "metadata": {
     "description": "Personal AI infrastructure - learning-enabled assistant for work, travel, and personal tasks",
-    "version": "0.8.0"
+    "version": "0.9.0"
   },
   "pluginRoot": ".",
   "plugins": [
     {
       "name": "geoffrey",
       "source": "./",
       "description": "Personal AI infrastructure with learning-enabled assistance for work, travel, and personal tasks",
-      "version": "0.8.0",
+      "version": "0.9.0",
       "category": "productivity",
       "keywords": [
         "personal-ai",

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "geoffrey",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Personal AI infrastructure with learning-enabled assistance for work, travel, and personal tasks",
   "author": {
     "name": "Kris Hagel",

CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Geoffrey will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-01-26
+
+### Added
+- **1Password CLI integration** for secure secrets management
+  - Centralized secrets modules (`scripts/secrets.js`, `scripts/secrets.py`)
+  - Setup documentation at `docs/1password-setup.md`
+  - Support for 10 secrets across 6 skills
+
+### Changed
+- **All skills now load secrets from 1Password** instead of `.env` file
+  - freshservice-manager: 13 scripts updated
+  - elevenlabs-tts: 2 scripts updated
+  - image-gen: 3 scripts updated
+  - multi-model-research: 1 script updated
+  - research: 1 script updated
+  - google-workspace: 2 auth scripts + package.json updated
+
+### Removed
+- `python-dotenv` dependency from Python scripts
+- `dotenv` dependency from google-workspace package.json
+- iCloud `.env` file requirement
+
+### Security
+- Secrets no longer stored as plaintext in iCloud
+- Leverages 1Password's security and biometric authentication
+- Secrets never written to disk by scripts
+
 ## [0.8.0] - 2026-01-24
 
 ### Added

README.md

@@ -1,6 +1,6 @@
 # Geoffrey - Personal AI Infrastructure
 
-[![Version](https://img.shields.io/badge/version-0.8.0-blue.svg)](https://github.com/krishagel/geoffrey/releases)
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](https://github.com/krishagel/geoffrey/releases)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Claude Code](https://img.shields.io/badge/Claude_Code-plugin-purple.svg)](https://claude.com/code)
 
@@ -20,7 +20,7 @@ claude plugin install geoffrey@geoffrey
 
 ## Current Status: Phase 2 (Core Skills)
 
-**Version:** 0.8.0
+**Version:** 0.9.0
 **Status:** In Active Development
 
 ### What Works Now
@@ -396,5 +396,5 @@ MIT License - see [LICENSE](LICENSE) for details.
 
 **Built with ❤️ using Claude Code**
 
-*Version: 0.8.0 | Phase 2 (Core Skills)*
+*Version: 0.9.0 | Phase 2 (Core Skills)*
 *Last updated: January 24, 2026*

docs/1password-setup.md

@@ -0,0 +1,128 @@
+# 1Password Setup for Geoffrey
+
+Geoffrey uses 1Password CLI to securely manage API keys and secrets. This replaces the previous `.env` file approach.
+
+## Prerequisites
+
+1. **Install 1Password CLI**
+   ```bash
+   brew install --cask 1password-cli
+   ```
+
+2. **Enable CLI Integration in 1Password App**
+   - Open 1Password app
+   - Go to Settings → Developer
+   - Enable "Integrate with 1Password CLI"
+
+3. **Authenticate**
+   ```bash
+   op signin
+   ```
+
+## Required 1Password Items
+
+Create the following items in a vault named "Geoffrey" (or update `VAULT_MAP` in `scripts/secrets.js` if using a different vault):
+
+### Freshservice
+- **Item name:** `Freshservice`
+- **Fields:**
+  - `domain` - Your Freshservice domain (e.g., `yourcompany.freshservice.com`)
+  - `api-key` - Your Freshservice API key
+
+### OpenAI
+- **Item name:** `OpenAI`
+- **Fields:**
+  - `api-key` - Your OpenAI API key
+
+### Gemini
+- **Item name:** `Gemini`
+- **Fields:**
+  - `api-key` - Your Google Gemini API key
+
+### Perplexity
+- **Item name:** `Perplexity`
+- **Fields:**
+  - `api-key` - Your Perplexity API key
+
+### XAI (Grok)
+- **Item name:** `XAI`
+- **Fields:**
+  - `api-key` - Your xAI API key
+
+### ElevenLabs
+- **Item name:** `ElevenLabs`
+- **Fields:**
+  - `api-key` - Your ElevenLabs API key
+
+### Google Workspace
+- **Item name:** `Google-Workspace`
+- **Fields:**
+  - `client-id` - Your Google OAuth client ID
+  - `client-secret` - Your Google OAuth client secret
+
+### Obsidian MCP
+- **Item name:** `Obsidian-MCP`
+- **Fields:**
+  - `api-key` - Your Obsidian Local REST API key
+
+## Secret References
+
+The centralized secrets module (`scripts/secrets.js` and `scripts/secrets.py`) maps environment variable names to 1Password secret references:
+
+| Secret Name | 1Password Reference |
+|-------------|---------------------|
+| `FRESHSERVICE_DOMAIN` | `op://Geoffrey/Freshservice/domain` |
+| `FRESHSERVICE_API_KEY` | `op://Geoffrey/Freshservice/api-key` |
+| `OPENAI_API_KEY` | `op://Geoffrey/OpenAI/api-key` |
+| `GEMINI_API_KEY` | `op://Geoffrey/Gemini/api-key` |
+| `PERPLEXITY_API_KEY` | `op://Geoffrey/Perplexity/api-key` |
+| `XAI_API_KEY` | `op://Geoffrey/XAI/api-key` |
+| `GOOGLE_CLIENT_ID` | `op://Geoffrey/Google-Workspace/client-id` |
+| `GOOGLE_CLIENT_SECRET` | `op://Geoffrey/Google-Workspace/client-secret` |
+| `ELEVENLABS_API_KEY` | `op://Geoffrey/ElevenLabs/api-key` |
+| `OBSIDIAN_API_KEY` | `op://Geoffrey/Obsidian-MCP/api-key` |
+
+## Testing
+
+Verify your setup by running:
+
+```bash
+# Test that 1Password CLI is working
+op whoami
+
+# Test secret retrieval
+op read "op://Geoffrey/Freshservice/api-key"
+```
+
+## Troubleshooting
+
+### "1Password CLI is not available or not authenticated"
+
+1. Ensure 1Password CLI is installed: `which op`
+2. Ensure CLI integration is enabled in 1Password app settings
+3. Sign in: `op signin`
+
+### "Secret not found"
+
+1. Verify the item exists in your 1Password vault
+2. Check that the vault name matches (default: "Geoffrey")
+3. Check that field names match (use lowercase with hyphens)
+
+### Changing the Vault Name
+
+If your vault has a different name, update `VAULT_MAP` in both:
+- `scripts/secrets.js`
+- `scripts/secrets.py`
+
+Replace `op://Geoffrey/...` with `op://YourVaultName/...`
+
+## Migration from .env
+
+If you previously used the `.env` file approach:
+
+1. Create the required items in 1Password (see above)
+2. Copy your API keys from `.env` to the corresponding 1Password fields
+3. Verify scripts work with `bun` or `uv run`
+4. Delete the old `.env` file from iCloud
+
+The `.env` file location was: `~/Library/Mobile Documents/com~apple~CloudDocs/Geoffrey/secrets/.env`

package.json

@@ -1,6 +1,6 @@
 {
   "name": "geoffrey",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Personal AI infrastructure with learning-enabled assistance for work, travel, and personal tasks",
   "type": "module",
   "author": {