macos

My coding agents read secrets from one 1Password vault as a service account, through a small op shim. My own terminal keeps the full account.