2026-10-02 Fri
My thoughts
- considering 1Password/Environments versus fnox
- Setting up a 1Password Environment by hand is slow and error-prone. I will go to a secret, copy it, then go to an environment, paste it. Each time takes multiple clicks and screens. If I have 3 repos with 3 tiers each, that's something like 50 clicks, each one of which takes 15-90 seconds. That's ~45 minutes, if I do it perfectly the first time. But my clipboard buffer only contains the secret, not the name, so in practice, I need an external staging area, which itself seems like an antipattern.
- Also, a 1Password Environment can't be shared with other people, unless one is using a team or business account; an Environment is shared through Manage environment > Manage access, per Environment, with view, edit or manage permission for people or groups. The limit I hit is probably the account type, not the feature.
- Ten local
.env files runs out fast with coding agents. The docs say "up to ten enabled local .env files per device", and agents each want a mount per git worktree.- A mount is turned off with the Enabled toggle in the desktop app. The docs describe no other way to remove one. GUIs are for human clickers. Not fun.
- The 1Password/Environment/MCP server has eight tools:
append_variables, authenticate, create_environment, rename_environment, create_local_env_file, list_environments, list_variables, list_local_env_files. It can create a mount but has no tool to disable or delete one, so each old worktree's mount would become a chore for a human to clean up.- A test run bore this out: deleting a mount's folder left the mount registered. See 1Password/Environment, Experiments.
- The same docs page warns that mounted files "aren't designed for concurrent access", and that the first read raises an approval prompt. Approval lasts until 1Password locks, with no re-approval for further reads. The file is a UNIX named pipe, so the contents are handed to each reader on demand, but the docs say that once it is unlocked "every process can read it" until 1Password locks or the file is disabled. Approval is not tied to the process that triggered the prompt: the docs say "There's no distinction made between different processes reading the file." (Local .env files)
- Leaning: use fnox instead of Environments while the secrets still live in 1Password.
- fnox's
op provider reads 1Password references. fnox sync --local-file caches the values encrypted under an age key, optionally kept in the Secure Enclave behind Touch ID through age-plugin-se. See fnox/How To/Use Apple Secure Enclave Touch ID.- Each worktree gets an encrypted copy, and deleting the worktree deletes it. Sync guide
- fnox also has an opt-in in-memory fnox/Daemon; whether worktrees share its cache is untested. I'm a bit hesitant to use this feature, as it's unlikely to be as secure as 1Password.
Filed
- 1password
- aws
- claude code
- etymology
- fnox
- frontmatter definitions
- people
- podcasts
- tuicr
- 1password
- entities
- frontmatter definitions
- people
- proxy pages