Xero

Use the read-only 1Password service account token in:

/Users/danielhowells/.codex/plugins/secrets/1password-service-account.env

Run the bootstrap and requested command in the same non-interactive subprocess. Require the service-account file and assignment before invoking op:

set -eu
credential_file=/Users/danielhowells/.codex/plugins/secrets/1password-service-account.env
test -r "$credential_file" || { echo 'Service-account file missing' >&2; exit 1; }
set -a
. "$credential_file"
set +a
test -n "${OP_SERVICE_ACCOUNT_TOKEN:-}" || { echo 'Service-account token missing' >&2; exit 1; }

Load the Xero credentials at runtime with op run using: