diff --git a/config/claude/pushover.sh b/config/claude/pushover.sh
index 49287bd7d..b1d1c3694 100755
--- a/config/claude/pushover.sh
+++ b/config/claude/pushover.sh
@@ -24,8 +24,8 @@ fi
 # Read JSON input from stdin
 input=$(cat)
 
-# Get hostname for notifications (with fallback)
-HOSTNAME=$(hostname -s 2>/dev/null || echo "unknown")
+# Get Computer Name for notifications (macOS friendly name, fallback to hostname)
+HOSTNAME=$(scutil --get ComputerName 2>/dev/null || hostname -s 2>/dev/null || echo "unknown")
 if [ -z "$HOSTNAME" ]; then
   HOSTNAME="unknown"
 fi
diff --git a/config/cliproxyapi/config.yaml b/config/cliproxyapi/config.yaml
index 1dca65915..d192837aa 100644
--- a/config/cliproxyapi/config.yaml
+++ b/config/cliproxyapi/config.yaml
@@ -77,6 +77,12 @@ openai-compatibility:
       - "__OPENROUTER_API_KEY__"
     models:
       - name: "z-ai/glm-4.6"
+  - name: "z-ai"
+    base-url: "https://api.z.ai/api/coding/paas/v4"
+    api-keys:
+      - "__ZAI_API_KEY__"
+    models:
+      - name: "glm-4.6"
 
 # payload: # Optional payload configuration
 #   default: # Default rules only set parameters when they are missing in the payload.
diff --git a/config/opencode/opencode.jsonc b/config/opencode/opencode.jsonc
index 775e56da5..82d3839aa 100644
--- a/config/opencode/opencode.jsonc
+++ b/config/opencode/opencode.jsonc
@@ -188,6 +188,19 @@
 						}
 					}
 				}
+			},
+			"options": {
+				"apiKey": "{env:OPENROUTER_API_KEY}"
+			}
+		},
+		"z-ai": {
+			"models": {
+				"glm-4.6": {
+					"name": "GLM-4.6 (via Z-AI)",
+				}
+			},
+			"options": {
+				"apiKey": "{env:ZAI_API_KEY}",
 			}
 		}
 	},
diff --git a/home-manager/default.nix b/home-manager/default.nix
index d321a8bc6..425ca014f 100644
--- a/home-manager/default.nix
+++ b/home-manager/default.nix
@@ -16,7 +16,7 @@ let
     sources = { };
   };
   services = import ./services {
-    inherit pkgs;
+    inherit config lib pkgs;
   };
 in
 {
@@ -35,7 +35,7 @@ in
   home.packages = packages;
   home.stateVersion = "24.11";
 
-  programs.yek.enable = true;
+  modules.yek.enable = true;
 
   accounts.email.accounts = {
     Gmail = {
diff --git a/home-manager/modules/yek/default.nix b/home-manager/modules/yek/default.nix
index 5259c75d8..248c9f550 100644
--- a/home-manager/modules/yek/default.nix
+++ b/home-manager/modules/yek/default.nix
@@ -8,7 +8,7 @@
 with lib;
 
 let
-  cfg = config.programs.yek;
+  cfg = config.modules.yek;
 
   # Determine the target platform string
   target =
@@ -71,7 +71,7 @@ let
   '';
 in
 {
-  options.programs.yek = {
+  options.modules.yek = {
     enable = mkEnableOption "yek - serialize text files for LLM consumption";
 
     package = mkOption {
diff --git a/home-manager/services/cliproxyapi/default.nix b/home-manager/services/cliproxyapi/default.nix
index 5de48177c..66b1b049a 100644
--- a/home-manager/services/cliproxyapi/default.nix
+++ b/home-manager/services/cliproxyapi/default.nix
@@ -3,6 +3,7 @@ let
   inherit (pkgs) lib;
 in
 {
+  # Main cliproxyapi service
   launchd.agents.cliproxyapi = lib.mkIf pkgs.stdenv.isDarwin {
     enable = true;
     config = {
@@ -41,4 +42,43 @@ in
       WantedBy = [ "default.target" ];
     };
   };
+
+  # Backup/recovery service
+  launchd.agents.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isDarwin {
+    enable = true;
+    config = {
+      ProgramArguments = [
+        "${pkgs.bash}/bin/bash"
+        "${./scripts/backup-and-recover.sh}"
+      ];
+      StartInterval = 300; # Run every 5 minutes
+      RunAtLoad = true;
+      StandardOutPath = "/tmp/cliproxyapi-backup.log";
+      StandardErrorPath = "/tmp/cliproxyapi-backup.error.log";
+    };
+  };
+
+  systemd.user.timers.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isLinux {
+    Unit = {
+      Description = "CLIProxyAPI auth backup and recovery timer";
+    };
+    Timer = {
+      OnBootSec = "1min";
+      OnUnitActiveSec = "5min";
+      Unit = "cliproxyapi-backup.service";
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+  systemd.user.services.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isLinux {
+    Unit = {
+      Description = "CLIProxyAPI auth backup and recovery";
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.bash}/bin/bash ${./scripts/backup-and-recover.sh}";
+    };
+  };
 }
diff --git a/home-manager/services/cliproxyapi/scripts/backup-and-recover.sh b/home-manager/services/cliproxyapi/scripts/backup-and-recover.sh
new file mode 100644
index 000000000..acaabf7c8
--- /dev/null
+++ b/home-manager/services/cliproxyapi/scripts/backup-and-recover.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Combined backup and recovery script
+# Backs up auth files to R2, then recovers if missing
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Source .env for credentials
+if [ -f "$HOME/dotfiles/.env" ]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "$HOME/dotfiles/.env"
+  set +a
+fi
+
+# Run backup
+echo "[$(date)] Starting backup..."
+"$SCRIPT_DIR/backup-auth.sh"
+
+# Run recovery if needed
+echo "[$(date)] Checking for recovery..."
+"$SCRIPT_DIR/recover-auth.sh"
+
+echo "[$(date)] Backup/recovery cycle complete"
diff --git a/home-manager/services/cliproxyapi/scripts/backup-auth.sh b/home-manager/services/cliproxyapi/scripts/backup-auth.sh
new file mode 100755
index 000000000..f2f434c06
--- /dev/null
+++ b/home-manager/services/cliproxyapi/scripts/backup-auth.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Backup auth files to R2 before service start
+# Protects against race condition deletions
+
+set -euo pipefail
+
+CONFIG_DIR="$HOME/.cli-proxy-api"
+BACKUP_DIR="s3://cliproxyapi/backup/auths/"
+AUTH_DIR="$CONFIG_DIR/objectstore/auths"
+
+# Check if auth directory has files
+if [ -d "$AUTH_DIR" ] && [ -n "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+  echo "Backing up auth files to R2 backup directory..." >&2
+  AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \
+    AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \
+    aws s3 sync \
+    --endpoint-url="${OBJECTSTORE_ENDPOINT}" \
+    --no-progress \
+    "$AUTH_DIR/" \
+    "$BACKUP_DIR" 2>/dev/null || echo "⚠️  Backup failed (continuing anyway)" >&2
+fi
diff --git a/home-manager/services/cliproxyapi/scripts/recover-auth.sh b/home-manager/services/cliproxyapi/scripts/recover-auth.sh
new file mode 100755
index 000000000..0ffa593fe
--- /dev/null
+++ b/home-manager/services/cliproxyapi/scripts/recover-auth.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Recover auth files from backup if missing
+# Handles race condition where files get deleted during config reload
+
+set -euo pipefail
+
+CONFIG_DIR="$HOME/.cli-proxy-api"
+BACKUP_DIR="s3://cliproxyapi/backup/auths/"
+AUTH_DIR="$CONFIG_DIR/objectstore/auths"
+
+# Check if auth directory is missing or empty
+if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+  echo "Auth files missing, attempting recovery from R2 backup..." >&2
+  mkdir -p "$AUTH_DIR"
+  AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \
+    AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \
+    aws s3 sync \
+    --endpoint-url="${OBJECTSTORE_ENDPOINT}" \
+    --no-progress \
+    "$BACKUP_DIR" \
+    "$AUTH_DIR/" 2>/dev/null && echo "✅ Recovered auth files from backup" >&2 || echo "⚠️  Recovery failed (no backup available?)" >&2
+fi
diff --git a/home-manager/services/cliproxyapi/start.sh b/home-manager/services/cliproxyapi/start.sh
index 70aecea80..6cf66b488 100755
--- a/home-manager/services/cliproxyapi/start.sh
+++ b/home-manager/services/cliproxyapi/start.sh
@@ -18,22 +18,37 @@ fi
 # Export management password for Management API (CLIProxyAPI requires MANAGEMENT_PASSWORD env var)
 export MANAGEMENT_PASSWORD="${CLIPROXY_MANAGEMENT_PASSWORD:-}"
 
+# Export S3-compatible object storage env vars (needed for backup/recovery)
+export OBJECTSTORE_ENDPOINT="${OBJECTSTORE_ENDPOINT:-${AWS_S3_ENDPOINT:-}}"
+export OBJECTSTORE_BUCKET="${OBJECTSTORE_BUCKET:-${AWS_S3_BUCKET:-}}"
+export OBJECTSTORE_ACCESS_KEY="${OBJECTSTORE_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
+export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
+
+# Backup auth files to R2 before starting service
+# This protects against race condition deletions
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -x "$SCRIPT_DIR/scripts/backup-auth.sh" ]; then
+  bash "$SCRIPT_DIR/scripts/backup-auth.sh"
+fi
+
 # Generate config from template with secrets injected
 if [ -f "$TEMPLATE" ]; then
-  sed -e "s|__OPENROUTER_API_KEY__|${OPENROUTER_API_KEY:-}|g" \
+  sed \
+    -e "s|__OPENROUTER_API_KEY__|${OPENROUTER_API_KEY:-}|g" \
     -e "s|__CLIPROXY_MANAGEMENT_PASSWORD__|${CLIPROXY_MANAGEMENT_PASSWORD:-}|g" \
+    -e "s|__ZAI_API_KEY__|${ZAI_API_KEY:-}|g" \
     "$TEMPLATE" >"$CONFIG"
 fi
 
+# Recover auth files from backup if they're missing
+# This handles race condition where files get deleted during config reload
+if [ -x "$SCRIPT_DIR/scripts/recover-auth.sh" ]; then
+  bash "$SCRIPT_DIR/scripts/recover-auth.sh"
+fi
+
 # Change to config dir so logs are created there
 cd "$CONFIG_DIR"
 
-# Export S3-compatible object storage env vars (for R2 or any S3-compatible storage)
-export OBJECTSTORE_ENDPOINT="${OBJECTSTORE_ENDPOINT:-${AWS_S3_ENDPOINT:-}}"
-export OBJECTSTORE_BUCKET="${OBJECTSTORE_BUCKET:-${AWS_S3_BUCKET:-}}"
-export OBJECTSTORE_ACCESS_KEY="${OBJECTSTORE_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
-export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
-
 # Find and exec cliproxyapi with config file
 if [ -x /opt/homebrew/bin/cliproxyapi ]; then
   exec /opt/homebrew/bin/cliproxyapi -config "$CONFIG" "$@"
diff --git a/home-manager/services/default.nix b/home-manager/services/default.nix
index a568c2310..1f10d31e0 100644
--- a/home-manager/services/default.nix
+++ b/home-manager/services/default.nix
@@ -1,12 +1,19 @@
-{ pkgs }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
+  brewUpgrader = import ./brew-upgrader { inherit pkgs; };
   cliproxyapi = import ./cliproxyapi { inherit pkgs; };
   codeSyncer = import ./code-syncer { inherit pkgs; };
   dotfilesUpdater = import ./dotfiles-updater { inherit pkgs; };
   neversslKeepalive = import ./neverssl-keepalive { inherit pkgs; };
   ollama = import ./ollama { inherit pkgs; };
-  brewUpgrader = import ./brew-upgrader { inherit pkgs; };
-  sshAgent = import ./ssh-agent.nix;
+  sshAgent = import ./ssh-agent {
+    inherit config lib pkgs;
+  };
 in
 [
   brewUpgrader
diff --git a/home-manager/services/ssh-agent.nix b/home-manager/services/ssh-agent/default.nix
similarity index 80%
rename from home-manager/services/ssh-agent.nix
rename to home-manager/services/ssh-agent/default.nix
index ff35c9329..74de9e76d 100644
--- a/home-manager/services/ssh-agent.nix
+++ b/home-manager/services/ssh-agent/default.nix
@@ -18,16 +18,11 @@ in
         # Load keys that exist
         set -l keys
 
-        # Always try to load the default key (no passphrase)
+        # Always try to load the default key
         if test -f ~/.ssh/id_ed25519
           set -a keys ~/.ssh/id_ed25519
         end
 
-        # Load GitHub key if it exists (may have passphrase)
-        if test -f ~/.ssh/id_ed25519_github
-          set -a keys ~/.ssh/id_ed25519_github
-        end
-
         # Initialize keychain with found keys
         if test (count $keys) -gt 0
           # Use --quiet to suppress most output, --eval to set environment variables
diff --git a/spec/cliproxyapi_backup_spec.sh b/spec/cliproxyapi_backup_spec.sh
new file mode 100644
index 000000000..4f6cbbbfe
--- /dev/null
+++ b/spec/cliproxyapi_backup_spec.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2329,SC2016
+
+Describe 'cliproxyapi backup scripts'
+SCRIPTS_DIR="$PWD/home-manager/services/cliproxyapi/scripts"
+
+Describe 'backup-auth.sh'
+SCRIPT="$SCRIPTS_DIR/backup-auth.sh"
+
+setup() {
+  mock_bin_setup aws
+  TEMP_HOME=$(mktemp -d)
+  mkdir -p "$TEMP_HOME/.cli-proxy-api/objectstore/auths"
+
+  # Unset objectstore credentials to ensure clean test environment
+  unset OBJECTSTORE_ACCESS_KEY
+  unset OBJECTSTORE_SECRET_KEY
+  unset OBJECTSTORE_ENDPOINT
+}
+
+cleanup() {
+  rm -rf "$TEMP_HOME"
+  mock_bin_cleanup
+}
+
+Before 'setup'
+After 'cleanup'
+
+It 'skips backup when auth directory is empty'
+When run bash -c 'env HOME="'"$TEMP_HOME"'" OBJECTSTORE_ACCESS_KEY=key OBJECTSTORE_SECRET_KEY=secret OBJECTSTORE_ENDPOINT=https://example.com bash '"$SCRIPT"'; cat "$MOCK_LOG" 2>/dev/null || true'
+The status should be success
+The output should eq ''
+End
+
+It 'calls aws s3 sync when auth files exist'
+touch "$TEMP_HOME/.cli-proxy-api/objectstore/auths/test-auth.json"
+When run bash -c 'env HOME="'"$TEMP_HOME"'" OBJECTSTORE_ACCESS_KEY=key OBJECTSTORE_SECRET_KEY=secret OBJECTSTORE_ENDPOINT=https://example.com bash '"$SCRIPT"' 2>&1; cat "$MOCK_LOG"'
+The status should be success
+The output should include 's3 sync'
+The output should include 's3://cliproxyapi/backup/auths/'
+End
+End
+
+Describe 'recover-auth.sh'
+SCRIPT="$SCRIPTS_DIR/recover-auth.sh"
+
+setup() {
+  mock_bin_setup aws
+  TEMP_HOME=$(mktemp -d)
+
+  unset OBJECTSTORE_ACCESS_KEY
+  unset OBJECTSTORE_SECRET_KEY
+  unset OBJECTSTORE_ENDPOINT
+}
+
+cleanup() {
+  rm -rf "$TEMP_HOME"
+  mock_bin_cleanup
+}
+
+Before 'setup'
+After 'cleanup'
+
+It 'attempts recovery when auth directory is missing'
+When run bash -c 'env HOME="'"$TEMP_HOME"'" OBJECTSTORE_ACCESS_KEY=key OBJECTSTORE_SECRET_KEY=secret OBJECTSTORE_ENDPOINT=https://example.com bash '"$SCRIPT"' 2>&1; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Auth files missing'
+The output should include 's3 sync'
+End
+
+It 'skips recovery when auth files exist'
+mkdir -p "$TEMP_HOME/.cli-proxy-api/objectstore/auths"
+touch "$TEMP_HOME/.cli-proxy-api/objectstore/auths/existing.json"
+When run bash -c 'env HOME="'"$TEMP_HOME"'" OBJECTSTORE_ACCESS_KEY=key OBJECTSTORE_SECRET_KEY=secret OBJECTSTORE_ENDPOINT=https://example.com bash '"$SCRIPT"' 2>&1; cat "$MOCK_LOG" 2>/dev/null || true'
+The status should be success
+The output should eq ''
+End
+End
+
+Describe 'backup-and-recover.sh'
+SCRIPT="$SCRIPTS_DIR/backup-and-recover.sh"
+
+setup() {
+  mock_bin_setup aws
+  TEMP_HOME=$(mktemp -d)
+  mkdir -p "$TEMP_HOME/.cli-proxy-api/objectstore/auths"
+  mkdir -p "$TEMP_HOME/dotfiles"
+
+  # Create .env with test credentials
+  cat >"$TEMP_HOME/dotfiles/.env" <<'ENV'
+OBJECTSTORE_ACCESS_KEY=test_key
+OBJECTSTORE_SECRET_KEY=test_secret
+OBJECTSTORE_ENDPOINT=https://test.endpoint.com
+ENV
+
+  unset OBJECTSTORE_ACCESS_KEY
+  unset OBJECTSTORE_SECRET_KEY
+  unset OBJECTSTORE_ENDPOINT
+}
+
+cleanup() {
+  rm -rf "$TEMP_HOME"
+  mock_bin_cleanup
+}
+
+Before 'setup'
+After 'cleanup'
+
+It 'sources .env and runs backup and recovery scripts'
+When run bash -c 'env HOME="'"$TEMP_HOME"'" bash '"$SCRIPT"' 2>&1'
+The status should be success
+The output should include 'Starting backup'
+The output should include 'Checking for recovery'
+The output should include 'Backup/recovery cycle complete'
+End
+End
+
+End
diff --git a/spec/code_syncer_spec.sh b/spec/code_syncer_spec.sh
index 53763ad2f..48af8036c 100644
--- a/spec/code_syncer_spec.sh
+++ b/spec/code_syncer_spec.sh
@@ -7,6 +7,8 @@ SCRIPT="$PWD/home-manager/services/code-syncer/sync.sh"
 Describe 'VS Code CLI detection'
 setup() {
   TEMP_HOME=$(mktemp -d)
+  # Create empty bin dir to use as PATH, hiding real 'code' command
+  EMPTY_BIN=$(mktemp -d)
   OS_TYPE="$(uname -s)"
   if [ "$OS_TYPE" = "Darwin" ]; then
     mkdir -p "$TEMP_HOME/Library/Application Support/Code/User"
@@ -24,67 +26,30 @@ setup() {
 }
 
 cleanup() {
-  rm -rf "$TEMP_HOME"
+  rm -rf "$TEMP_HOME" "$EMPTY_BIN"
 }
 
 Before 'setup'
 After 'cleanup'
 
 It 'exits with error when VS Code CLI not found'
-When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT' 2>&1"
+# Use restricted PATH with only essential commands, hiding 'code'
+When run bash -c "HOME='$TEMP_HOME' PATH='$EMPTY_BIN:/usr/bin:/bin' bash '$SCRIPT' 2>&1"
 The output should include 'VS Code CLI not found'
 The status should be failure
 End
 End
 
 Describe 'extension filtering'
-setup() {
-  mock_bin_setup code fswatch inotifywait
-  TEMP_HOME=$(mktemp -d)
-
-  # Create required directories
-  OS_TYPE="$(uname -s)"
-  if [ "$OS_TYPE" = "Darwin" ]; then
-    mkdir -p "$TEMP_HOME/Library/Application Support/Code/User"
-    mkdir -p "$TEMP_HOME/Library/Application Support/Cursor/User"
-    mkdir -p "$TEMP_HOME/Library/Application Support/Windsurf/User"
-    mkdir -p "$TEMP_HOME/Library/Application Support/Antigravity/User"
-    mkdir -p "$TEMP_HOME/Library/Application Support/Code - Insiders/User"
-  else
-    mkdir -p "$TEMP_HOME/.config/Code/User"
-    mkdir -p "$TEMP_HOME/.config/Cursor/User"
-    mkdir -p "$TEMP_HOME/.config/Windsurf/User"
-    mkdir -p "$TEMP_HOME/.config/Antigravity/User"
-    mkdir -p "$TEMP_HOME/.config/Code - Insiders/User"
-  fi
-
-  # Create mock VS Code CLI that lists extensions
-  cat >"$MOCK_BIN/code" <<'EOF'
-#!/usr/bin/env bash
-: "${MOCK_LOG:?MOCK_LOG must be set}"
-if [[ "$1" == "--list-extensions" ]]; then
-  echo "esbenp.prettier-vscode"
-  echo "github.copilot"
-  echo "ms-python.python"
-  echo "bradlc.vscode-tailwindcss"
-fi
-printf '%s\n' "code $*" >>"$MOCK_LOG"
-exit 0
-EOF
-  chmod +x "$MOCK_BIN/code"
-}
-
-cleanup() {
-  rm -rf "$TEMP_HOME"
-  mock_bin_cleanup
-}
-
-Before 'setup'
-After 'cleanup'
+It 'uses code --list-extensions to get extensions'
+When run bash -c "grep -E 'code.*--list-extensions' '$SCRIPT'"
+The output should include '--list-extensions'
+The status should be success
+End
 
-It 'lists VS Code extensions'
-When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT' 2>&1 | head -20"
-The output should include 'extension'
+It 'filters extensions through clean_extension_list function'
+When run bash -c "grep 'clean_extension_list' '$SCRIPT'"
+The output should include 'clean_extension_list'
 The status should be success
 End
 End
@@ -105,66 +70,21 @@ End
 End
 
 Describe 'config file syncing'
-setup() {
-  mock_bin_setup code fswatch cp inotifywait
-  TEMP_HOME=$(mktemp -d)
-
-  # Detect OS and create appropriate directories
-  OS_TYPE="$(uname -s)"
-  if [ "$OS_TYPE" = "Darwin" ]; then
-    VSCODE_DIR="$TEMP_HOME/Library/Application Support/Code/User"
-    VSCODE_INSIDERS_DIR="$TEMP_HOME/Library/Application Support/Code - Insiders/User"
-    CURSOR_DIR="$TEMP_HOME/Library/Application Support/Cursor/User"
-    WINDSURF_DIR="$TEMP_HOME/Library/Application Support/Windsurf/User"
-    ANTIGRAVITY_DIR="$TEMP_HOME/Library/Application Support/Antigravity/User"
-  else
-    VSCODE_DIR="$TEMP_HOME/.config/Code/User"
-    VSCODE_INSIDERS_DIR="$TEMP_HOME/.config/Code - Insiders/User"
-    CURSOR_DIR="$TEMP_HOME/.config/Cursor/User"
-    WINDSURF_DIR="$TEMP_HOME/.config/Windsurf/User"
-    ANTIGRAVITY_DIR="$TEMP_HOME/.config/Antigravity/User"
-  fi
-
-  # Create VS Code user directory with config files
-  mkdir -p "$VSCODE_DIR"
-  echo '{"editor.fontSize": 14}' >"$VSCODE_DIR/settings.json"
-  echo '[]' >"$VSCODE_DIR/keybindings.json"
-
-  # Create target directories
-  mkdir -p "$CURSOR_DIR"
-  mkdir -p "$WINDSURF_DIR"
-  mkdir -p "$ANTIGRAVITY_DIR"
-  mkdir -p "$VSCODE_INSIDERS_DIR"
-
-  # Create code mock
-  cat >"$MOCK_BIN/code" <<'EOF'
-#!/usr/bin/env bash
-: "${MOCK_LOG:?MOCK_LOG must be set}"
-if [[ "$1" == "--list-extensions" ]]; then
-  echo "esbenp.prettier-vscode"
-fi
-printf '%s\n' "code $*" >>"$MOCK_LOG"
-exit 0
-EOF
-  chmod +x "$MOCK_BIN/code"
-}
-
-cleanup() {
-  rm -rf "$TEMP_HOME"
-  mock_bin_cleanup
-}
-
-Before 'setup'
-After 'cleanup'
+It 'defines sync_config_file function with cp'
+When run bash -c "grep -A 15 'sync_config_file()' '$SCRIPT'"
+The output should include 'sync_config_file'
+The output should include 'cp'
+The status should be success
+End
 
-It 'copies settings.json to target editors'
-When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT' 2>&1 | head -30"
+It 'syncs settings.json file'
+When run bash -c "grep 'SETTINGS_FILE' '$SCRIPT'"
 The output should include 'settings.json'
 The status should be success
 End
 
-It 'copies keybindings.json to target editors'
-When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT' 2>&1 | head -30"
+It 'syncs keybindings.json file'
+When run bash -c "grep 'KEYBINDINGS_FILE' '$SCRIPT'"
 The output should include 'keybindings.json'
 The status should be success
 End
diff --git a/spec/coverage_spec.sh b/spec/coverage_spec.sh
index b047d1cfc..f092158aa 100644
--- a/spec/coverage_spec.sh
+++ b/spec/coverage_spec.sh
@@ -29,6 +29,18 @@ It 'has spec file for home-manager/services/cliproxyapi/start.sh'
 The path "spec/cliproxyapi_spec.sh" should be exist
 End
 
+It 'has spec file for home-manager/services/cliproxyapi/scripts/backup-and-recover.sh'
+The path "spec/cliproxyapi_backup_spec.sh" should be exist
+End
+
+It 'has spec file for home-manager/services/cliproxyapi/scripts/backup-auth.sh'
+The path "spec/cliproxyapi_backup_spec.sh" should be exist
+End
+
+It 'has spec file for home-manager/services/cliproxyapi/scripts/recover-auth.sh'
+The path "spec/cliproxyapi_backup_spec.sh" should be exist
+End
+
 It 'has spec file for home-manager/services/code-syncer/sync.sh'
 The path "spec/code_syncer_spec.sh" should be exist
 End
@@ -70,6 +82,9 @@ config/claude/pushover.sh
 config/claude/security.sh
 home-manager/programs/neovim/run_tests.sh
 home-manager/services/brew-upgrader/upgrade.sh
+home-manager/services/cliproxyapi/scripts/backup-and-recover.sh
+home-manager/services/cliproxyapi/scripts/backup-auth.sh
+home-manager/services/cliproxyapi/scripts/recover-auth.sh
 home-manager/services/cliproxyapi/start.sh
 home-manager/services/code-syncer/sync.sh
 home-manager/services/dotfiles-updater/update.sh