Refactor SSH agent keychain integration for Linux

config/claude/pushover.sh

@@ -24,8 +24,8 @@ fi
 # Read JSON input from stdin
 input=$(cat)
 
-# Get hostname for notifications (with fallback)
-HOSTNAME=$(hostname -s 2>/dev/null || echo "unknown")
+# Get Computer Name for notifications (macOS friendly name, fallback to hostname)
+HOSTNAME=$(scutil --get ComputerName 2>/dev/null || hostname -s 2>/dev/null || echo "unknown")
 if [ -z "$HOSTNAME" ]; then
   HOSTNAME="unknown"
 fi

config/cliproxyapi/config.yaml

@@ -77,6 +77,12 @@ openai-compatibility:
       - "__OPENROUTER_API_KEY__"
     models:
       - name: "z-ai/glm-4.6"
+  - name: "z-ai"
+    base-url: "https://api.z.ai/api/coding/paas/v4"
+    api-keys:
+      - "__ZAI_API_KEY__"
+    models:
+      - name: "glm-4.6"
 
 # payload: # Optional payload configuration
 #   default: # Default rules only set parameters when they are missing in the payload.

config/opencode/opencode.jsonc

@@ -188,6 +188,19 @@
 						}
 					}
 				}
+			},
+			"options": {
+				"apiKey": "{env:OPENROUTER_API_KEY}"
+			}
+		},
+		"z-ai": {
+			"models": {
+				"glm-4.6": {
+					"name": "GLM-4.6 (via Z-AI)",
+				}
+			},
+			"options": {
+				"apiKey": "{env:ZAI_API_KEY}",
 			}
 		}
 	},

home-manager/default.nix

@@ -16,7 +16,7 @@ let
     sources = { };
   };
   services = import ./services {
-    inherit pkgs;
+    inherit config lib pkgs;
   };
 in
 {
@@ -35,7 +35,7 @@ in
   home.packages = packages;
   home.stateVersion = "24.11";
 
-  programs.yek.enable = true;
+  modules.yek.enable = true;
 
   accounts.email.accounts = {
     Gmail = {

home-manager/modules/yek/default.nix

@@ -8,7 +8,7 @@
 with lib;
 
 let
-  cfg = config.programs.yek;
+  cfg = config.modules.yek;
 
   # Determine the target platform string
   target =
@@ -71,7 +71,7 @@ let
   '';
 in
 {
-  options.programs.yek = {
+  options.modules.yek = {
     enable = mkEnableOption "yek - serialize text files for LLM consumption";
 
     package = mkOption {

home-manager/services/cliproxyapi/default.nix

@@ -3,6 +3,7 @@ let
   inherit (pkgs) lib;
 in
 {
+  # Main cliproxyapi service
   launchd.agents.cliproxyapi = lib.mkIf pkgs.stdenv.isDarwin {
     enable = true;
     config = {
@@ -41,4 +42,43 @@ in
       WantedBy = [ "default.target" ];
     };
   };
+
+  # Backup/recovery service
+  launchd.agents.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isDarwin {
+    enable = true;
+    config = {
+      ProgramArguments = [
+        "${pkgs.bash}/bin/bash"
+        "${./scripts/backup-and-recover.sh}"
+      ];
+      StartInterval = 300; # Run every 5 minutes
+      RunAtLoad = true;
+      StandardOutPath = "/tmp/cliproxyapi-backup.log";
+      StandardErrorPath = "/tmp/cliproxyapi-backup.error.log";
+    };
+  };
+
+  systemd.user.timers.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isLinux {
+    Unit = {
+      Description = "CLIProxyAPI auth backup and recovery timer";
+    };
+    Timer = {
+      OnBootSec = "1min";
+      OnUnitActiveSec = "5min";
+      Unit = "cliproxyapi-backup.service";
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+  systemd.user.services.cliproxyapi-backup = lib.mkIf pkgs.stdenv.isLinux {
+    Unit = {
+      Description = "CLIProxyAPI auth backup and recovery";
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.bash}/bin/bash ${./scripts/backup-and-recover.sh}";
+    };
+  };
 }

home-manager/services/cliproxyapi/scripts/backup-and-recover.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Combined backup and recovery script
+# Backs up auth files to R2, then recovers if missing
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Source .env for credentials
+if [ -f "$HOME/dotfiles/.env" ]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "$HOME/dotfiles/.env"
+  set +a
+fi
+
+# Run backup
+echo "[$(date)] Starting backup..."
+"$SCRIPT_DIR/backup-auth.sh"
+
+# Run recovery if needed
+echo "[$(date)] Checking for recovery..."
+"$SCRIPT_DIR/recover-auth.sh"
+
+echo "[$(date)] Backup/recovery cycle complete"

home-manager/services/cliproxyapi/scripts/backup-auth.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Backup auth files to R2 before service start
+# Protects against race condition deletions
+
+set -euo pipefail
+
+CONFIG_DIR="$HOME/.cli-proxy-api"
+BACKUP_DIR="s3://cliproxyapi/backup/auths/"
+AUTH_DIR="$CONFIG_DIR/objectstore/auths"
+
+# Check if auth directory has files
+if [ -d "$AUTH_DIR" ] && [ -n "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+  echo "Backing up auth files to R2 backup directory..." >&2
+  AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \
+    AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \
+    aws s3 sync \
+    --endpoint-url="${OBJECTSTORE_ENDPOINT}" \
+    --no-progress \
+    "$AUTH_DIR/" \
+    "$BACKUP_DIR" 2>/dev/null || echo "⚠️  Backup failed (continuing anyway)" >&2
+fi

home-manager/services/cliproxyapi/scripts/recover-auth.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Recover auth files from backup if missing
+# Handles race condition where files get deleted during config reload
+
+set -euo pipefail
+
+CONFIG_DIR="$HOME/.cli-proxy-api"
+BACKUP_DIR="s3://cliproxyapi/backup/auths/"
+AUTH_DIR="$CONFIG_DIR/objectstore/auths"
+
+# Check if auth directory is missing or empty
+if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then
+  echo "Auth files missing, attempting recovery from R2 backup..." >&2
+  mkdir -p "$AUTH_DIR"
+  AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \
+    AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \
+    aws s3 sync \
+    --endpoint-url="${OBJECTSTORE_ENDPOINT}" \
+    --no-progress \
+    "$BACKUP_DIR" \
+    "$AUTH_DIR/" 2>/dev/null && echo "✅ Recovered auth files from backup" >&2 || echo "⚠️  Recovery failed (no backup available?)" >&2
+fi

home-manager/services/cliproxyapi/start.sh

@@ -18,22 +18,37 @@ fi
 # Export management password for Management API (CLIProxyAPI requires MANAGEMENT_PASSWORD env var)
 export MANAGEMENT_PASSWORD="${CLIPROXY_MANAGEMENT_PASSWORD:-}"
 
+# Export S3-compatible object storage env vars (needed for backup/recovery)
+export OBJECTSTORE_ENDPOINT="${OBJECTSTORE_ENDPOINT:-${AWS_S3_ENDPOINT:-}}"
+export OBJECTSTORE_BUCKET="${OBJECTSTORE_BUCKET:-${AWS_S3_BUCKET:-}}"
+export OBJECTSTORE_ACCESS_KEY="${OBJECTSTORE_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
+export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
+
+# Backup auth files to R2 before starting service
+# This protects against race condition deletions
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -x "$SCRIPT_DIR/scripts/backup-auth.sh" ]; then
+  bash "$SCRIPT_DIR/scripts/backup-auth.sh"
+fi
+
 # Generate config from template with secrets injected
 if [ -f "$TEMPLATE" ]; then
-  sed -e "s|__OPENROUTER_API_KEY__|${OPENROUTER_API_KEY:-}|g" \
+  sed \
+    -e "s|__OPENROUTER_API_KEY__|${OPENROUTER_API_KEY:-}|g" \
     -e "s|__CLIPROXY_MANAGEMENT_PASSWORD__|${CLIPROXY_MANAGEMENT_PASSWORD:-}|g" \
+    -e "s|__ZAI_API_KEY__|${ZAI_API_KEY:-}|g" \
     "$TEMPLATE" >"$CONFIG"
 fi
 
+# Recover auth files from backup if they're missing
+# This handles race condition where files get deleted during config reload
+if [ -x "$SCRIPT_DIR/scripts/recover-auth.sh" ]; then
+  bash "$SCRIPT_DIR/scripts/recover-auth.sh"
+fi
+
 # Change to config dir so logs are created there
 cd "$CONFIG_DIR"
 
-# Export S3-compatible object storage env vars (for R2 or any S3-compatible storage)
-export OBJECTSTORE_ENDPOINT="${OBJECTSTORE_ENDPOINT:-${AWS_S3_ENDPOINT:-}}"
-export OBJECTSTORE_BUCKET="${OBJECTSTORE_BUCKET:-${AWS_S3_BUCKET:-}}"
-export OBJECTSTORE_ACCESS_KEY="${OBJECTSTORE_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
-export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
-
 # Find and exec cliproxyapi with config file
 if [ -x /opt/homebrew/bin/cliproxyapi ]; then
   exec /opt/homebrew/bin/cliproxyapi -config "$CONFIG" "$@"

home-manager/services/default.nix

@@ -1,12 +1,19 @@
-{ pkgs }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
+  brewUpgrader = import ./brew-upgrader { inherit pkgs; };
   cliproxyapi = import ./cliproxyapi { inherit pkgs; };
   codeSyncer = import ./code-syncer { inherit pkgs; };
   dotfilesUpdater = import ./dotfiles-updater { inherit pkgs; };
   neversslKeepalive = import ./neverssl-keepalive { inherit pkgs; };
   ollama = import ./ollama { inherit pkgs; };
-  brewUpgrader = import ./brew-upgrader { inherit pkgs; };
-  sshAgent = import ./ssh-agent.nix;
+  sshAgent = import ./ssh-agent {
+    inherit config lib pkgs;
+  };
 in
 [
   brewUpgrader

home-manager/services/ssh-agent.nix → home-manager/services/ssh-agent/default.nix

@@ -18,16 +18,11 @@ in
         # Load keys that exist
         set -l keys
 
-        # Always try to load the default key (no passphrase)
+        # Always try to load the default key
         if test -f ~/.ssh/id_ed25519
           set -a keys ~/.ssh/id_ed25519
         end
 
-        # Load GitHub key if it exists (may have passphrase)
-        if test -f ~/.ssh/id_ed25519_github
-          set -a keys ~/.ssh/id_ed25519_github
-        end
-
         # Initialize keychain with found keys
         if test (count $keys) -gt 0
           # Use --quiet to suppress most output, --eval to set environment variables