[mturilin]

Adds the SOPS plugin: an editor for SOPS-encrypted files in a thread's side panel.

What it does

• Encrypted files panel action lists the SOPS files in the thread's repo (found by sops metadata, not by name) with format, number of settings and age recipients, without decrypting.
• Editor: a table view for .env files (values hidden until shown, copy, replace with a random secret) and a CodeMirror text view for YAML, JSON, INI and plain text; a review dialog before saving.
• Saves through sops edit, so only changed values get new ciphertext. The result is decrypted again and compared with the input; on mismatch the original bytes are restored. A save is refused when the file changed on disk since it was opened.
• A file opener for .env: an encrypted file opens in the editor, any other .env falls back to BB's preview.

Source

• Git: https://github.com/mturilin/bb-plugin-sops.git, range ^0.1.1 (tag v0.1.1).

Checks

• Plugin: npx tsc -p . clean; npm test 14/14 pass (includes end-to-end tests against real sops and age with a throwaway key); bb plugin build passes; installed from the Git source and exercised live (list, decrypt, save, stale-save refusal).
• Marketplace: npm ci --ignore-scripts, npm run build, npm test, npm run gate:v1 and npm run check all pass.

Permissions, services, security

• No network service, account or key of its own. Runs the user's sops (through mise exec in the file's folder when mise is installed) on the machine BB runs on.
• File references from the browser are re-checked on the server: the file must be inside the thread's folder or a folder from the plugin's settings (real paths, so symlinks cannot lead out) and must carry sops metadata.
• The plugin writes no plaintext to disk and logs no values. sops itself keeps a private temporary file while re-encrypting, as sops edit does in a terminal.

Screenshots

All taken with a demo folder of made-up secrets encrypted to a throwaway key.

1. env-table.png — the table view of a .env file, values hidden, one empty value.
2. file-list.png — the Encrypted files list.
3. text-editor.png — the text editor on a JSON file, values shown.

Overview

overview/sops.md is the plugin repository's PLUGIN_OVERVIEW.md, rewritten with the author.

[SawyerHood]

Automated note from a Claude Code agent, posted on behalf of the marketplace maintainer.

Reviewed and verified the submitted change under the maintainer admission policy. Required CI passes; approved for merge.