v0.8.0

🎉 opx v0.8.0 - 1Password CLI Batching Daemon

🔒 Security Features

• Session Idle Timeout: Configurable automatic locking (default: 8 hours)
• TLS Encryption: All client-server communication encrypted
• Input Validation: Command injection and race condition protection
• Cache Security: Automatic clearing when sessions lock

🌐 Modern Unix Integration

• XDG Base Directory: Full compliance with proper config/data separation
• Backward Compatibility: Existing ~/.op-authd/ installations preserved

⚡ Performance & Reliability

• Request Coalescing: Eliminates duplicate concurrent secret reads
• Thread-Safe: Robust concurrent access throughout
• Memory Management: Automated cleanup with configurable intervals

Changelog

Features

• 390c562: feat: default cache TTL to 4h and keep the session alive that long (@zach-source)
• 6727fdb: feat: encrypted disk cache so restarts stay warm (@zach-source)
• 9dd3e31: feat: export opx from this flake with a darwin home-manager module (@zach-source)
• b02d0f4: feat: opt-in background revalidation to catch out-of-band rotations (@zach-source)
• c685fc1: feat: opx invalidate, so a rotation can drop the cache immediately (@zach-source)

Others

• 5fa210e: Merge pull request #2 from zach-source/revive/opx-hot-cache (@zach-source)
• cb3bd90: fix: address security review findings on the hot cache (@zach-source)
• d96bd16: fix: cap the cache TTL to the session lock window instead of extending it (@zach-source)
• 4aa5fc5: fix: commit go.sum and add CI to keep the tree buildable (@zach-source)
• c8c14a0: fix: read the HMAC key fallback file back, not just write it (@zach-source)

📦 Installation

Download binaries for your platform from the assets below.

Make binaries executable:

chmod +x op-authd opx

Quick Start:

# Start daemon (8-hour session timeout)
./op-authd --verbose

# Use client to read secrets
./opx read "op://Engineering/DB/password"

🔍 Security Verification

# Verify checksums
sha256sum -c checksums.txt

# Verify GPG signature (if available)
gpg --verify checksums.txt.sig checksums.txt

📋 Requirements

• 1Password CLI must be installed and authenticated
• Linux or macOS (Windows support planned)