onepasslisted

# onepass — secrets live in 1Password, code holds only `op://` references ## Step 0 — Preflight (every invocation) Run `bash <skill-dir>/scripts/preflight.sh`: exit `0` (desktop or service-account mode) → proceed; exit `2` → offer `scripts/install-op.sh` (Linux path adds the signed repo + uses `sudo` — announce first), rerun; exit `1` → auth failed: fire the announce below, then `ask_question` for the mode and follow `references/auth-setup.md` — **auth happens in a separate terminal** (this session shares no TTY with the biometric prompt, and exports here don't persist). Never run `op item create`/`edit` before preflight returns 0 — failed writes leave half-created items and burn service-account rate limit. <!-- announce-template: "Autenticação do 1Password necessária. Aguardando escolha do modo de acesso. Projeto {PROJECT}." --> ```bash bravros ha say --force "Autenticação do 1Password necessária. Aguardando escolha do modo de acesso. Projeto $(basename "$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")")." studio >/dev/null 2>&1 || true ``` ## Naming & metadata — enforce before create (non-negotiable) `op://` references are parsed strictly — a title with an em-dash or parens **silently** breaks every script that reads it. - **Title:** `<Service> - <Project> <Purpose>`, ASCII only (letters, digits, spaces, `-`, `_`). Auto-rewrite anything with `— ( ) + & @ /` or emoji; show the rewrite and confirm. `scripts/validate-title.sh` checks + suggests. - **