Add 1Password brokered credential vault commands

[rgarcia]

Depends on kernel/kernel#4256; do not merge before it lands and a Go SDK release includes it.

Summary

• vaults and vaults credentials help now describe two credential paths, Kernel-hosted collection and 1Password brokered approval, and tell agents to ask the user which one they want. They also say never to ask for passwords, OAuth codes, or keys in the terminal or chat.
• vaults credentials connect <vault> <account-key> --provider 1password creates a credential_account item and shows the 1Password authorization URL. It always uses the Kernel-managed OAuth client.
• vaults credentials create sends the spec's provider. A spec without one defaults to kernel, so existing spec files keep working now that the API requires the field. A 1password spec carries account_id and a v2 requests object.
• vaults items invoke supports 1pw_create_access_request, 1pw_access_request_status, 1pw_fill, and 1pw_recover, each only when the item advertises it. There is no reset or reconcile operation: after a failed or uncertain access request or fill, the help says to stop and tell the user rather than retry. 1pw_recover returns a new link for recovering a failed account connection.
  • Parameters are strict: unknown or duplicate keys are rejected, and the CLI adds type itself.
  • For 1pw_fill, fill_submitted exits 0. fill_failed and fill_unknown exit nonzero, and the guidance says not to retry.
• Output stays display-safe. It adds account_id, requests, the non-secret access_request fields, and action instructions. The provider-opaque identity and path are dropped. The native onepassword://grant-brokered-access?access_request_reference=… link is shown only on a 1password_access_approval action with exactly that shape. Request website values go through the same URL filter as other URLs.

Not included (design still under review)

• The CLI does not expose customer-owned 1Password OAuth clients (customer_managed credential accounts or 1password vault-provider-configs). Only the Kernel-managed client is sent.
• credentials update still covers Kernel-hosted credentials only.

Temporary SDK pin

go.mod pins the Go SDK to the private stlc preview generated from kernel/kernel#4256 at edb30b1 (stlc run 36183731121):

replace github.com/kernel/kernel-go-sdk => github.com/kernel/kernel-go-sdk-staging v0.86.1-0.20260925200915-a98c8419227e

That is commit a98c8419227eef638434cc6f9abb0fb63ba1d7c1 on stlc/preview/pr-4256. The preview repository is private, so CI jobs that download modules without access to it (test, preview binaries) are expected to fail until the pin is swapped. Local builds need GOPRIVATE=github.com/kernel/* and access to that repository.

TODO before merge: delete the replace line, bump github.com/kernel/kernel-go-sdk to the official release that includes kernel/kernel#4256, and run go mod tidy. The TODO is also in go.mod.

Validation

• go build ./..., go vet ./..., and go test ./... against the preview SDK: all pass.
• New cmd/vaults_onepassword_test.go covers:
  • the request bodies for connect, create, and each operation
  • parameter validation, with no API call on invalid input
  • the not-advertised gate
  • fill outcomes and exit codes
  • output redaction, including forged approval links
  • help content
• Two existing tests were updated to expect provider: "kernel" in create requests.
• Not run: golangci-lint, and any call against a live API. The API's 1Password broker is local-only in #4256.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3bc99e5. Configure here.}