feat(installer): collapse OP_ITEM+OP_FIELD into one secret-reference prompt

[busla]

Summary

The two-prompt flow (item path → field name) was a synthetic split of what 1Password already gives users as one value. The desktop app has a Copy Secret Reference option (right-click an item) that produces op://Vault/Item/Field directly, wrapped in double quotes for paste-safety.

Replace both prompts with a single one that accepts that exact format, including the surrounding quotes. Split into OP_ITEM (vault/item) and OP_FIELD (everything after) at write time, so the internal storage and runtime contract stay unchanged — claude-env.sh / claudestart.ps1 still append /<project> with /<OP_FIELD> as fallback.

This also obsoletes:

• list_op_fields / prompt_op_field (bash) and Get-OpFields / Prompt-OpField (PowerShell). Interactive field enumeration was only useful when the user had to type the field name from memory; with Copy Secret Reference there's nothing to enumerate.
• The migration warning block from fix: PowerShell parser bug + migrate legacy 3-segment OP_ITEM #14. The installer just uses whatever existing local.env produces (legacy 3-segment OP_ITEM, modern split, or team default) as the prompt's bracketed default.

Net -138 lines.

New flow

LiteLLM base URL [https://litellm.ai.apro.is]:
1Password secret reference (Copy Secret Reference in 1Password) [op://Employee/ai.apro.is litellm/API Key]: "op://Employee/Litellm Apro user/API Key"
                                                                                                              ^ pasted with quotes; stripped, validated, split
[OK]    Wrote ~/.config/claude/local.env

local.env ends up with:

OP_ITEM="op://Employee/Litellm Apro user"
OP_FIELD="API Key"

Existing user upgrade paths

local.env state before reinstall	New prompt's default
Legacy 3-seg OP_ITEM (e.g. op://V/I/Field), no OP_FIELD	op://V/I/Field (use as-is)
Modern split (OP_ITEM + OP_FIELD)	${OP_ITEM}/${OP_FIELD} (joined)
2-seg OP_ITEM only	${OP_ITEM}/API Key
Empty / no prior install	op://Employee/ai.apro.is litellm/API Key

In all cases the user can hit enter to keep their existing config, or paste a new secret reference to switch.

Validation

The single prompt rejects:

• Inputs not starting with op://
• Fewer than 3 path segments (i.e. missing field)
• Empty vault or item

A 4-segment op://V/I/Section/Field is accepted; the section/field combo is preserved as OP_FIELD=Section/Field.

Test plan

• bash -n install.sh
• Functional parse test of 7 inputs covering quoted/unquoted, 3-seg, 4-seg with section, 2-seg (rejected), trailing slash (rejected), empty middle (rejected), non-op:// (rejected) — all behave correctly
• Verified no orphan references to the removed list_op_fields / prompt_op_field / Get-OpFields / Prompt-OpField helpers
• Windows user reruns irm .../install.ps1 | iex and pastes "op://Employee/liteLLM/API key" from 1Password desktop — should accept cleanly
• macOS user reruns curl .../install.sh | bash — should behave identically

🤖 Generated with Claude Code