cliproxyapi fix

Makefile

@@ -778,11 +778,10 @@ launchctl-ollama: ## Restart ollama launchd agent.
 systemctl: systemctl-cliproxyapi systemctl-code-syncer systemctl-docker-postgres systemctl-dotfiles-updater systemctl-ollama systemctl-openclaw ## Restart all systemd user services.
 
 .PHONY: systemctl-cliproxyapi
-systemctl-cliproxyapi: ## Pull latest image and restart cliproxyapi systemd user service.
-	@echo "🔄 Restarting cliproxyapi..."
+systemctl-cliproxyapi: ## Reload systemd units for cliproxyapi (home-manager handles restart).
+	@echo "🔄 Reloading cliproxyapi..."
 	@systemctl --user daemon-reload
-	@systemctl --user restart cliproxyapi.service || true
-	@echo "✅ cliproxyapi restarted"
+	@echo "✅ cliproxyapi reloaded"
 
 .PHONY: systemctl-code-syncer
 systemctl-code-syncer: ## Restart code-syncer systemd user service.

config/claude/settings.json

@@ -330,6 +330,8 @@
       "Bash(rm -rf /*:*)",
       "Bash(rm -rf ~/*:*)",
       "Bash(chmod -R 777:*)",
+      "Bash(docker system prune -a:*)",
+      "Bash(docker system prune -f:*)",
       "Bash(mkfs:*)",
       "Bash(dd if=:*)",
       "Bash(git push --force origin main:*)",

config/openclaw/hydrate.sh

@@ -9,6 +9,7 @@ STATE_DIR="${OPENCLAW_STATE_DIR:-${HOME}/.openclaw}"
 CONFIG="${OPENCLAW_CONFIG_PATH:-${STATE_DIR}/openclaw.json}"
 TEMPLATE="@template@"
 SECRETS_DIR="${HOME}/.config/openclaw"
+CLIPROXY_CONFIG="${OPENCLAW_CLIPROXY_CONFIG_PATH:-${HOME}/.cli-proxy-api/config.yaml}"
 ENV_FILE="${HOME}/dotfiles/.env"
 
 # Source .env if it exists
@@ -30,6 +31,23 @@ read_secret() {
   echo ""
 }
 
+read_cliproxy_api_key_from_config() {
+  local config_file="$1"
+  [ -f "$config_file" ] || return 0
+
+  awk '
+    /^api-keys:/ { in_api_keys = 1; next }
+    in_api_keys && /^  - / {
+      value = $0
+      sub(/^  - "/, "", value)
+      sub(/"$/, "", value)
+      print value
+      exit
+    }
+    in_api_keys && /^[^[:space:]]/ { exit }
+  ' "$config_file"
+}
+
 # Load gateway token (required for both modes)
 GATEWAY_TOKEN="${OPENCLAW_GATEWAY_TOKEN:-${GATEWAY_TOKEN:-$(read_secret "${SECRETS_DIR}/gateway-token")}}"
 
@@ -42,7 +60,17 @@ mkdir -p "$STATE_DIR"
 
 if [ "$MODE" = "gateway" ]; then
   # Gateway mode (Kyber): hydrate full template and start gateway
-  CLIPROXY_API_KEY="${OPENCLAW_CLIPROXY_API_KEY:-${CLIPROXY_API_KEY:-$(read_secret "${SECRETS_DIR}/cliproxy-key")}}"
+  cliproxy_api_key_from_env="${CLIPROXY_API_KEY:-}"
+  CLIPROXY_API_KEY="${OPENCLAW_CLIPROXY_API_KEY:-}"
+  if [ -z "$CLIPROXY_API_KEY" ]; then
+    CLIPROXY_API_KEY="$(read_cliproxy_api_key_from_config "$CLIPROXY_CONFIG")"
+  fi
+  if [ -z "$CLIPROXY_API_KEY" ]; then
+    CLIPROXY_API_KEY="$cliproxy_api_key_from_env"
+  fi
+  if [ -z "$CLIPROXY_API_KEY" ]; then
+    CLIPROXY_API_KEY="$(read_secret "${SECRETS_DIR}/cliproxy-key")"
+  fi
   TELEGRAM_TOKEN="${OPENCLAW_TELEGRAM_TOKEN:-${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}}"
   WHATSAPP_ALLOW_FROM="${OPENCLAW_WHATSAPP_ALLOW_FROM:-${WHATSAPP_ALLOW_FROM:-$(read_secret "${SECRETS_DIR}/whatsapp-allow-from")}}"
   ANTHROPIC_API_KEY="${OPENCLAW_ANTHROPIC_API_KEY:-${ANTHROPIC_API_KEY:-$(read_secret "${SECRETS_DIR}/anthropic-key")}}"

config/pi/settings.json

@@ -24,7 +24,8 @@
     "keepRecentTokens": 20000
   },
   "packages": [
-    "https://github.com/davebcn87/pi-autoresearch"
+    "https://github.com/davebcn87/pi-autoresearch",
+    "https://github.com/cagdotin/agents"
   ],
   "skills": [],
   "retry": {

home-manager/services/cliproxyapi/README.md

@@ -30,31 +30,13 @@ This directory contains the Nix-based configuration for the cliproxyapi service
 ~/.ccs/cliproxy/auth/              # CCS auth directory (synced from local)
 
 S3 Storage:
-├── s3://cliproxyapi/auths/        # Primary storage
-└── s3://cliproxyapi/backup/auths/ # Redundant backup
+└── s3://cliproxyapi/auths/        # Auth storage
 ```
 
 ## Data Flow
 
-```
-┌─────────────────────────────────────────────────────────┐
-│                     S3 (Source of Truth)                │
-│  ┌──────────────┐         ┌───────────────────────┐     │
-│  │ auths/       │         │ backup/auths/         │     │
-│  └──────┬───────┘         └───────────┬───────────┘     │
-└─────────┼─────────────────────────────┼─────────────────┘
-          │                             │
-          ▼         hydrate.sh          ▼
-┌─────────────────────────────────────────────────────────┐
-│              ~/.cli-proxy-api/objectstore/auths/        │
-│                      (local cache)                      │
-└─────────────────────────┬───────────────────────────────┘
-                          │
-                          ▼  backup.sh (on file change)
-┌─────────────────────────────────────────────────────────┐
-│                  ~/.ccs/cliproxy/auth/                  │
-│                    (CCS compatibility)                  │
-└─────────────────────────────────────────────────────────┘
+``` 
+S3 auths/ -> ~/.cli-proxy-api/objectstore/auths -> ~/.ccs/cliproxy/auth
 ```
 
 ### Pre-start guard (service)
@@ -72,14 +54,12 @@ key error when S3 already has auths.
 ### Hydrate (on activation/switch)
 
 1. Pull from S3 `auths/` → local
-2. Pull from S3 `backup/auths/` → local (takes precedence, overwrites conflicts)
-3. Copy local → CCS auth dir
+2. Copy local → CCS auth dir
 
 ### Backup (on file change)
 
 1. Push local → S3 `auths/`
-2. Push local → S3 `backup/auths/`
-3. Copy local → CCS auth dir
+2. Copy local → CCS auth dir
 
 ### WatchPaths (file watchers)
 

home-manager/services/cliproxyapi/default.nix

@@ -9,17 +9,22 @@ let
     config.home.homeDirectory
       or (if pkgs.stdenv.isDarwin then builtins.getEnv "HOME" else "/home/${config.home.username}");
 
-  hydrateScript = pkgs.replaceVars ./scripts/hydrate.sh {
+  commonScript = pkgs.replaceVars ./scripts/common.sh {
     aws = "${pkgs.awscli2}/bin/aws";
   };
 
+  hydrateScript = pkgs.replaceVars ./scripts/hydrate.sh {
+    common = commonScript;
+  };
+
   backupScript = pkgs.replaceVars ./scripts/backup.sh {
-    aws = "${pkgs.awscli2}/bin/aws";
+    common = commonScript;
   };
 
   startScript = pkgs.replaceVars ./scripts/start.sh {
     sed = "${pkgs.gnused}/bin/sed";
     aws = "${pkgs.awscli2}/bin/aws";
+    common = commonScript;
   };
 
   # Smart wrapper that handles both NixOS and non-NixOS Linux
@@ -45,7 +50,7 @@ let
   '';
 
   wrapperScript = pkgs.replaceVars ./scripts/wrapper.sh {
-    aws = "${pkgs.awscli2}/bin/aws";
+    common = commonScript;
   };
 
   cliWrapper = pkgs.writeShellScriptBin "cliproxyapi" (builtins.readFile wrapperScript);

home-manager/services/cliproxyapi/scripts/backup.sh

@@ -2,28 +2,13 @@
 # Push auth files from local cache to S3
 # shellcheck source=/dev/null
 set -euo pipefail
+. "@common@"
 
 AUTH_DIR="${HOME}/.cli-proxy-api/objectstore/auths"
 CCS_AUTH_DIR="${HOME}/.ccs/cliproxy/auth"
-ENV_FILE="${HOME}/dotfiles/.env"
+cliproxy_init_objectstore_env
 
-if [ -f "$ENV_FILE" ]; then
-  set -a
-  . "$ENV_FILE"
-  set +a
-fi
-
-strip_quotes() {
-  local v="$1"
-  v="${v%\"}"
-  v="${v#\"}"
-  printf '%s' "$v"
-}
-ENDPOINT="$(strip_quotes "${OBJECTSTORE_ENDPOINT:-}")"
-ACCESS_KEY="$(strip_quotes "${OBJECTSTORE_ACCESS_KEY:-}")"
-SECRET_KEY="$(strip_quotes "${OBJECTSTORE_SECRET_KEY:-}")"
-
-if [ -z "$ENDPOINT" ] || [ -z "$ACCESS_KEY" ] || [ -z "$SECRET_KEY" ]; then
+if ! cliproxy_has_objectstore_credentials; then
   echo "⚠️  Missing S3 credentials, skipping backup" >&2
   exit 0
 fi
@@ -35,21 +20,7 @@ fi
 
 echo "[$(date)] Backing up auth files..." >&2
 
-AWS_ACCESS_KEY_ID="$ACCESS_KEY" \
-  AWS_SECRET_ACCESS_KEY="$SECRET_KEY" \
-  @aws@ s3 sync \
-  --endpoint-url="$ENDPOINT" \
-  --no-progress \
-  "$AUTH_DIR/" \
-  "s3://cliproxyapi/auths/" && echo "✅ Backed up to S3 auths/" >&2
-
-AWS_ACCESS_KEY_ID="$ACCESS_KEY" \
-  AWS_SECRET_ACCESS_KEY="$SECRET_KEY" \
-  @aws@ s3 sync \
-  --endpoint-url="$ENDPOINT" \
-  --no-progress \
-  "$AUTH_DIR/" \
-  "s3://cliproxyapi/backup/auths/" && echo "✅ Backed up to S3 backup/auths/" >&2
+cliproxy_sync_auth_to_s3 "$AUTH_DIR"
 
 # Also sync back to CCS auth dir so ccs can find the tokens
 mkdir -p "$CCS_AUTH_DIR"

home-manager/services/cliproxyapi/scripts/common.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+cliproxy_load_env() {
+  local env_file="${HOME}/dotfiles/.env"
+  if [ -f "$env_file" ]; then
+    set -a
+    # shellcheck source=/dev/null
+    . "$env_file"
+    set +a
+  fi
+}
+
+cliproxy_strip_quotes() {
+  local value="$1"
+  value="${value%\"}"
+  value="${value#\"}"
+  printf '%s' "$value"
+}
+
+cliproxy_init_objectstore_env() {
+  cliproxy_load_env
+  OBJECTSTORE_ENDPOINT="$(cliproxy_strip_quotes "${OBJECTSTORE_ENDPOINT:-}")"
+  OBJECTSTORE_BUCKET="$(cliproxy_strip_quotes "${OBJECTSTORE_BUCKET:-cliproxyapi}")"
+  OBJECTSTORE_ACCESS_KEY="$(cliproxy_strip_quotes "${OBJECTSTORE_ACCESS_KEY:-}")"
+  OBJECTSTORE_SECRET_KEY="$(cliproxy_strip_quotes "${OBJECTSTORE_SECRET_KEY:-}")"
+  export OBJECTSTORE_ENDPOINT OBJECTSTORE_BUCKET OBJECTSTORE_ACCESS_KEY OBJECTSTORE_SECRET_KEY
+}
+
+cliproxy_has_objectstore_credentials() {
+  [ -n "${OBJECTSTORE_ENDPOINT:-}" ] &&
+    [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ] &&
+    [ -n "${OBJECTSTORE_SECRET_KEY:-}" ]
+}
+
+cliproxy_auth_s3_uri() {
+  printf 's3://%s/auths/' "${OBJECTSTORE_BUCKET:?OBJECTSTORE_BUCKET is required}"
+}
+
+cliproxy_s3_sync() {
+  local source_path="$1"
+  local destination_path="$2"
+  AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY:?OBJECTSTORE_ACCESS_KEY is required}" \
+    AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY:?OBJECTSTORE_SECRET_KEY is required}" \
+    @aws@ s3 sync \
+    --endpoint-url="${OBJECTSTORE_ENDPOINT:?OBJECTSTORE_ENDPOINT is required}" \
+    --no-progress \
+    "$source_path" \
+    "$destination_path" || true
+}
+
+cliproxy_sync_auth_from_s3() {
+  local auth_dir="$1"
+  mkdir -p "$auth_dir"
+  cliproxy_s3_sync "$(cliproxy_auth_s3_uri)" "$auth_dir/"
+}
+
+cliproxy_sync_auth_to_s3() {
+  local auth_dir="$1"
+  cliproxy_s3_sync "$auth_dir/" "$(cliproxy_auth_s3_uri)"
+}

home-manager/services/cliproxyapi/scripts/hydrate.sh

@@ -2,49 +2,18 @@
 # Pull auth files from S3 to local cache
 # shellcheck source=/dev/null
 set -euo pipefail
+. "@common@"
 
 AUTH_DIR="${HOME}/.cli-proxy-api/objectstore/auths"
 CCS_AUTH_DIR="${HOME}/.ccs/cliproxy/auth"
-ENV_FILE="${HOME}/dotfiles/.env"
+cliproxy_init_objectstore_env
 
-if [ -f "$ENV_FILE" ]; then
-  set -a
-  . "$ENV_FILE"
-  set +a
-fi
-
-strip_quotes() {
-  local v="$1"
-  v="${v%\"}"
-  v="${v#\"}"
-  printf '%s' "$v"
-}
-ENDPOINT="$(strip_quotes "${OBJECTSTORE_ENDPOINT:-}")"
-ACCESS_KEY="$(strip_quotes "${OBJECTSTORE_ACCESS_KEY:-}")"
-SECRET_KEY="$(strip_quotes "${OBJECTSTORE_SECRET_KEY:-}")"
-
-if [ -z "$ENDPOINT" ] || [ -z "$ACCESS_KEY" ] || [ -z "$SECRET_KEY" ]; then
+if ! cliproxy_has_objectstore_credentials; then
   echo "⚠️  Missing S3 credentials, skipping hydrate" >&2
   exit 0
 fi
 
-mkdir -p "$AUTH_DIR"
-
-AWS_ACCESS_KEY_ID="$ACCESS_KEY" \
-  AWS_SECRET_ACCESS_KEY="$SECRET_KEY" \
-  @aws@ s3 sync \
-  --endpoint-url="$ENDPOINT" \
-  --no-progress \
-  "s3://cliproxyapi/auths/" \
-  "$AUTH_DIR/" && echo "✅ Hydrated from S3 auths/" >&2
-
-AWS_ACCESS_KEY_ID="$ACCESS_KEY" \
-  AWS_SECRET_ACCESS_KEY="$SECRET_KEY" \
-  @aws@ s3 sync \
-  --endpoint-url="$ENDPOINT" \
-  --no-progress \
-  "s3://cliproxyapi/backup/auths/" \
-  "$AUTH_DIR/" && echo "✅ Hydrated from S3 backup/auths/" >&2
+cliproxy_sync_auth_from_s3 "$AUTH_DIR"
 
 # Also sync to CCS auth dir so ccs can find the tokens
 mkdir -p "$CCS_AUTH_DIR"