function opx --description "Run command with 1Password secret refs resolved"
    set -l vars_to_resolve
    set -l refs

    for var in (set --names -x)
        set -l value $$var
        if string match -q 'op://*' -- $value
            set -a vars_to_resolve $var
            set -a refs $value
        end
    end

    if test (count $vars_to_resolve) -eq 0
        $argv
        return
    end

    # Build template: VAR=op://ref (one per line)
    set -l template_lines
    for i in (seq (count $vars_to_resolve))
        set -a template_lines "$vars_to_resolve[$i]=$refs[$i]"
    end

    # Single op call resolves everything
    set -l resolved_lines (printf '%s\n' $template_lines | op inject 2>/dev/null)
    if test $status -ne 0
        echo "opx: failed to resolve secrets" >&2
        return 1
    end

    # Check if the command is a fish function
    if functions -q $argv[1]
        # Parse resolved values (originals are in $refs)
        set -l resolved_values
        for line in $resolved_lines
            set -a resolved_values (string split -m1 '=' $line)[2]
        end
        # Set globals with resolved values
        for i in (seq (count $vars_to_resolve))
            set -gx $vars_to_resolve[$i] $resolved_values[$i]
        end
        # Run command
        $argv
        set -l cmd_status $status
        # Restore original op:// refs
        for i in (seq (count $vars_to_resolve))
            set -gx $vars_to_resolve[$i] $refs[$i]
        end
        return $cmd_status
    else
        env $resolved_lines $argv
    end
end