#556 @swamp/1password put double-escapes JSON values

Description

The @swamp/1password vault provider's put method passes secret values as positional arguments to op item edit and op item create:

// onepassword.ts line 242
`${parsed.field}=${secretValue}`

When secretValue contains JSON (e.g., a GCP service account key), the op CLI double-escapes the quotes, storing ""type"" instead of "type". The stored value is invalid JSON when read back via op item get --fields.

Confusingly, op item get --format=json returns the value correctly (the escaping is only in the text-mode --fields output), so the actual stored value in 1Password may be correct — but the behavior is inconsistent and caused us to debug a broken external-dns deployment for hours.

Steps to Reproduce

1. Configure a @swamp/1password vault
2. Store a JSON value: echo '{"type":"service_account","project_id":"test"}' | swamp vault put my-vault my-key
3. Read it back: swamp vault read-secret my-vault my-key --force --json
4. The returned value has double-escaped quotes

Expected Behavior

JSON values should round-trip cleanly through put → get.

Suggested Fix

Use op item edit with the template/stdin approach (pipe the full item JSON through jq and back to op item edit <name> -) instead of passing field values as CLI arguments. This is what we ended up doing in our workflow as a workaround.

Environment

• swamp version: 20260604.165624.0-sha.9bed22cc
• op CLI version: 2.x
• OS: macOS Darwin 25.4.0

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/1password@2026.05.23.1
• swamp: 20260604.165624.0-sha.9bed22cc
• OS: darwin (aarch64)
• Deno: 2.8.2
• Shell: /bin/zsh