function opx --description "Run command with 1Password secret refs resolved"
    set -l vars_to_resolve
    set -l refs

    for var in (set --names -x)
        set -l value $$var
        if string match -q 'op://*' -- $value
            set -a vars_to_resolve $var
            set -a refs $value
        end
    end

    if test (count $vars_to_resolve) -eq 0
        $argv
        return
    end

    # Build template: VAR=op://ref (one per line)
    set -l template_lines
    for i in (seq (count $vars_to_resolve))
        set -a template_lines "$vars_to_resolve[$i]=$refs[$i]"
    end

    # Single op call resolves everything
    set -l resolved_lines (printf '%s\n' $template_lines | op inject 2>/dev/null)
    if test $status -ne 0
        echo "opx: failed to resolve secrets" >&2
        return 1
    end

    env $resolved_lines $argv
end