[TMUX] Paste 1Password passwords with prefix+P

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tmux/.mac_config

@@ -1,4 +1,8 @@
 set-option -g default-shell /bin/zsh
+
+# prefix+P: paste a password from 1Password into the pane (e.g. remote sudo)
+# (via run-shell: display-popup does not expand formats in its command)
+bind P run-shell -b "tmux display-popup -c '#{client_name}' -E -w 80% -h 50% -T ' 1Password ' '$HOME/.tmux/op_password_paste.zsh #{pane_id} #{client_name}'"
 #bind -Tcopy-mode-vi y send -X copy-pipe "pbcopy" \; display-message "copied to system clipboard"
 #bind C-p run "tmux set-buffer \"$pbpaste\"; tmux paste-buffer"
 #bind C-y run "tmux save-buffer - | pbcopy"

tmux/op_password_paste.zsh

@@ -0,0 +1,92 @@
+#!/bin/zsh
+# Paste a password from 1Password into a tmux pane, e.g. at a remote sudo
+# prompt. Run in a popup (see .mac_config):
+#   op_password_paste.zsh <pane_id> [client_name]
+emulate -L zsh
+setopt extended_glob pipe_fail no_unset
+
+pane=${1:?usage: op_password_paste.zsh <pane_id> [client_name]}
+client=${2:-}
+# -l: messages may contain item titles, which must not be expanded as formats
+die() {
+    print -ru2 -- "1Password: $*"
+    tmux display-message -l ${client:+-c} $client "1Password: $*"
+    # keep the popup (and op's error output) visible until a key is pressed
+    [[ -t 0 ]] && read -sk1 "?Press any key to close."
+    exit 1
+}
+
+(( $+commands[op] )) || die "op CLI missing (brew install --cask 1password-cli)"
+
+# Guard: a paste outside a password prompt echoes the secret (and may run it).
+# The cursor line must end in a prompt like "[sudo] password for x:".
+cursor_line() {
+    local pos=$(tmux display-message -p -t $pane '#{cursor_x},#{cursor_y}')
+    print -r -- "$pos $(tmux capture-pane -p -t $pane -S ${pos#*,} -E ${pos#*,})"
+}
+prompt=$(cursor_line)
+if [[ ${prompt#* } != *(#i)(password|passphrase|passwort|kennwort)*:[[:space:]]# ]]; then
+    print -r -- "No password prompt at the cursor:"
+    print -r -- "  ${${prompt#* }:-<empty line>}"
+    read -q "?Paste anyway? [y/N] " || exit 0
+    print
+fi
+
+# Destination of an ssh running in the pane, used as the initial fzf query.
+ssh_host() {
+    local -a words=(${(z)1})
+    local w i
+    [[ ${words[1]:t} == ssh ]] || return 1
+    for (( i = 2; i <= $#words; i++ )); do
+        w=${words[i]}
+        if [[ $w == -- ]]; then
+            w=${words[i+1]:-}
+            break
+        elif [[ $w == -?* ]]; then
+            # option letters taking an argument; the last letter may take the next word
+            [[ $w == -[^BbcDEeFIiJLlmOoPpQRSWw]#[BbcDEeFIiJLlmOoPpQRSWw] ]] && (( i++ ))
+        else
+            break
+        fi
+    done
+    w=${${${w#ssh://}#*@}%%/*}
+    w=${w%:[0-9]##}
+    [[ -n $w ]] && print -r -- $w
+}
+
+host=
+tty=$(tmux display-message -p -t $pane '#{pane_tty}')
+for args in ${(f)"$(ps -o args= -t ${tty#/dev/} 2>/dev/null)"}; do
+    host=$(ssh_host $args) && break
+done
+
+# All signed-in accounts; the desktop app integration asks for Touch ID.
+accounts=(${(f)"$(op account list --format json | jq -r '.[].account_uuid')"}) ||
+    die "op account list failed"
+(( $#accounts )) || die "no 1Password account (enable CLI integration in the app)"
+rows=$(for acc in $accounts; do
+    op item list --account $acc --categories Login,Password,Server --format json |
+        jq -r --arg acc $acc '.[] | [$acc, .vault.id, .id, .title,
+            (.additional_information // ""), .vault.name,
+            ([.urls[]?.href] | join(" "))] | @tsv' || exit 1
+done) || die "op item list failed for an account"
+[[ -n $rows ]] || die "no Login/Password/Server items found"
+
+# The prefill comes from the local ssh; after another hop it names the wrong host.
+choice=$(print -r -- $rows | fzf --delimiter='\t' --with-nth=4.. --reverse \
+    --query=$host --prompt='password> ' \
+    --header="paste into $pane${host:+ (local ssh: $host)}") || exit 0
+fields=("${(@ps:\t:)choice}")
+
+pw=$(op read --account $fields[1] "op://$fields[2]/$fields[3]/password") ||
+    die "no 'password' field in ${fields[4]}"
+
+# Named buffer, deleted by paste-buffer -d; no clipboard (no load-buffer -w).
+buf=op-password-$$
+trap 'tmux delete-buffer -b $buf 2>/dev/null' EXIT
+print -rn -- $pw | tmux load-buffer -b $buf -
+pw=
+# Picking and Touch ID take a while: refuse if the prompt moved meanwhile
+# (sudo timeout, dropped connection).
+[[ "$(cursor_line)" == "$prompt" ]] || die "pane changed since the check, not pasted"
+tmux paste-buffer -d -b $buf -t $pane