Starling Bank

Use the read-only 1Password service account token in:

/Users/danielhowells/.codex/plugins/secrets/1password-service-account.env

Run this bootstrap and the requested command in the same non-interactive subprocess. Stop before op run if the file or service-account assignment is missing:

set -eu
credential_file=/Users/danielhowells/.codex/plugins/secrets/1password-service-account.env
test -r "$credential_file" || { echo 'Service-account file missing' >&2; exit 1; }
set -a
. "$credential_file"
set +a
test -n "${OP_SERVICE_ACCOUNT_TOKEN:-}" || { echo 'Service-account token missing' >&2; exit 1; }

Load every Starling token at runtime with op run using: