When you run /ops:setup, the wizard probes these sources to find credentials you already have — so you don't have to paste anything already on disk. This runs only during setup; never in the background, never during normal skill execution.

flowchart LR
 Start["/ops:setup"] --> Scan[Universal auto-scan]
 Scan --> E1[Env variables<br/>printenv]
 Scan --> E2[Shell profiles<br/>~/.zshrc, ~/.bashrc,<br/>~/.zprofile, ~/.envrc]
 Scan --> E3[Doppler<br/>doppler secrets get]
 Scan --> E4[1Password<br/>op]
 Scan --> E5[Dashlane<br/>dcli]
 Scan --> E6[Bitwarden<br/>bw]
 Scan --> E7[macOS Keychain<br/>security find-generic-password]
 Scan --> E8[~/.claude.json<br/>mcpServers, read-only]
 Scan --> E9[Chrome history<br/>URLs only, never content]
 Scan --> E10[Persistent browser profile<br/>opt-in, only for Slack fallback]
 E1 & E2 & E3 & E4 & E5 & E6 & E7 & E8 & E9 & E10 --> Result[Scan result]
 Result --> Show[Show to user]
 Show --> Decide[User decides: use / paste / skip]
 classDef scan fill:#6366f1,color:#fff,stroke:#4338ca
 classDef source fill:#22c55e,color:#fff,stroke:#15803d
 classDef user fill:#f59e0b,color:#fff,stroke:#b45309
 class Scan,Result scan
 class E1,E2,E3,E4,E5,E6,E7,E8,E9,E10 source
 class Start,Show,Decide user

Per Rule 3, the wizard never silently uses a discovered credential. You always see:

Found credential for SHOPIFY_ADMIN_TOKEN:
 [A] shell env + ~/.zshrc + Dashlane — shpat_508b...682e (matched 3 sources)
 [B] Doppler (project: mystore, config: prd) — shpat_9f2c...a17b (different!)
 [C] Paste a different one
 [D] Skip

• Reads: scripts/registry.json, last gather output
• Calls: aws, gh, wacli (local SQLite), gog (local cache), Shopify/Klaviyo/Meta Ads/GA4/Search Console APIs only if configured by the user. /ops:monitor additionally reaches Datadog / New Relic / OpenTelemetry endpoints only on-demand (never from the daemon).
• Writes: ~/.claude/plugins/data/ops-ops-marketplace/daemon-cache.json
• Outbound network: only to the user's own configured APIs. Nothing to claude-ops infrastructure (there is none).

• Reads: wacli local SQLite DB
• Calls: WhatsApp's servers via the WhatsApp Web protocol (same servers as your existing wacli install; claude-ops adds no new endpoints)
• Writes: ~/.wacli/.health, wacli's local SQLite

• Reads: wacli local SQLite, gog local cache
• Calls: Claude Haiku 4.5 (Anthropic API) to summarize — same API any Claude Code session uses
• Writes: ~/.claude/plugins/data/ops-ops-marketplace/memories/*.md (mode 600)
• Note: Message content is processed transiently by the Haiku prompt. The plugin does not send any additional telemetry to Anthropic beyond the API call itself.

• Reads: wacli SQLite, gog cache, Slack MCP (if configured), Telegram MCP (if configured)
• Writes: inbox digest log in plugin data dir
• Network: only to user-configured MCP endpoints

• Reads: registry
• Calls: Shopify Admin API only — no other platforms
• Writes: store-health report in plugin data dir

• Reads: user-specified competitor domains in preferences.json
• Calls: public websites (scraping) + Telegram bot for notifications (if configured)
• Writes: weekly brief in plugin data dir

• Reads: wacli + Telegram local state
• Writes: local event log the daemon picks up
• Never sends messages outbound on its own. Skills in an interactive Claude Code session are the only thing that can send.

When a skill needs a secret at runtime, it walks this chain — stopping at the first source that returns a value:

flowchart LR
 Skill[Skill needs<br/>API_KEY] --> S1{Doppler<br/>reference?}
 S1 -->|Yes| D[doppler secrets get]
 S1 -->|No| S2{Password<br/>manager?}
 S2 -->|Yes| PM[op/dcli/bw/keychain]
 S2 -->|No| S3{Keychain<br/>direct?}
 S3 -->|Yes| K[security find-generic-password]
 S3 -->|No| S4{Env var?}
 S4 -->|Yes| E[printenv]
 S4 -->|No| UC[userConfig<br/>~/.claude.json]
 D --> Use[Use value]
 PM --> Use
 K --> Use
 E --> Use
 UC --> Use
 classDef vault fill:#22c55e,color:#fff,stroke:#15803d
 classDef fallback fill:#f59e0b,color:#fff,stroke:#b45309
 class D,PM,K vault
 class E,UC fallback

• Auto-scan first, ask second. If your key is in Doppler, you never paste it.
• Reference tokens. doppler:KEY_NAME keeps secrets in the vault even in preferences.json.
• Fail-closed health checks. PreToolUse hooks warn instead of silently retrying with stale auth — you always know when the plugin is operating in degraded state.

/ops:uninstall

Removes:

• ~/Library/LaunchAgents/com.claude-ops.daemon.plist (macOS)
• ~/.claude/plugins/data/ops-ops-marketplace/ (preferences, memories, cache, logs)
• ~/.claude-ops/ (Playwright profile if used)
• ~/.wacli/.health (if you want — the uninstall asks)
• The CLAUDE_PLUGIN_ROOT export line in .zshrc / .bashrc
• The plugin entry in Claude Code's marketplace

Keeps (by default — you decide per-item):

• Your wacli install + session (that's a separate tool)
• Your gog install + session (that's a separate tool)
• Your Doppler / 1Password / Bitwarden installs
• Your ~/.claude.json Claude Code settings (the plugin never owned them)

• Plugin Rules — the five rules that enforce these properties
• Daemon Guide — exact cadence and behavior of each service
• Memories System — what local files the extractor creates
• Integrations — which integrations call which external APIs
• Source code — audit-ready, MIT