1function opx --description "Run command with 1Password secret refs resolved"
 2    set -l vars_to_resolve
 3    set -l refs
 4
 5    for var in (set --names -x)
 6        set -l value $$var
 7        if string match -q 'op://*' -- $value
 8            set -a vars_to_resolve $var
 9            set -a refs $value
10        end
11    end
12
13    if test (count $vars_to_resolve) -eq 0
14        $argv
15        return
16    end
17
18    # Build template: VAR=op://ref (one per line)
19    set -l template_lines
20    for i in (seq (count $vars_to_resolve))
21        set -a template_lines "$vars_to_resolve[$i]=$refs[$i]"
22    end
23
24    # Single op call resolves everything
25    set -l resolved_lines (printf '%s\n' $template_lines | op inject 2>/dev/null)
26    if test $status -ne 0
27        echo "opx: failed to resolve secrets" >&2
28        return 1
29    end
30
31    env $resolved_lines $argv
32end