diff --git a/config/cliproxyapi/config.yaml b/config/cliproxyapi/config.yaml
index d192837aa..f0807eec7 100644
--- a/config/cliproxyapi/config.yaml
+++ b/config/cliproxyapi/config.yaml
@@ -13,10 +13,9 @@ remote-management:
   disable-control-panel: false
 # Authentication directory (supports ~ for home directory). If you use Windows, please set the directory like this: `C:/cli-proxy-api/`
 auth-dir: "~/.cli-proxy-api"
-# API keys for authentication
+# API keys for client authentication (optional - leave commented for open access)
 # api-keys:
-#   - "your-api-key-1"
-#   - "your-api-key-2"
+#   - "your-api-key"
 
 # Enable debug logging
 debug: true
@@ -34,12 +33,11 @@ quota-exceeded:
   switch-preview-model: true # Whether to automatically switch to a preview model when a quota is exceeded
 # When true, enable authentication for the WebSocket API (/v1/ws).
 ws-auth: false
-# AMP
+# AMP integration
 ampcode:
   upstream-url: "https://ampcode.com"
-  restrict-management-to-localhost: true
-# amp-upstream-api-key: "" # Optional - use AMP_API_KEY env var or ~/.local/share/amp/secrets.json
-
+  upstream-api-key: "__AMP_UPSTREAM_API_KEY__"
+  restrict-management-to-localhost: false
 # Gemini API keys (preferred)
 # gemini-api-key:
 #   - api-key: "AIzaSy...01"
@@ -77,12 +75,14 @@ openai-compatibility:
       - "__OPENROUTER_API_KEY__"
     models:
       - name: "z-ai/glm-4.6"
+      - name: "z-ai/glm-4.7"
   - name: "z-ai"
     base-url: "https://api.z.ai/api/coding/paas/v4"
     api-keys:
       - "__ZAI_API_KEY__"
     models:
       - name: "glm-4.6"
+      - name: "glm-4.7"
 
 # payload: # Optional payload configuration
 #   default: # Default rules only set parameters when they are missing in the payload.
diff --git a/config/opencode/opencode.jsonc b/config/opencode/opencode.jsonc
index 82d3839aa..c4f33a113 100644
--- a/config/opencode/opencode.jsonc
+++ b/config/opencode/opencode.jsonc
@@ -197,6 +197,9 @@
 			"models": {
 				"glm-4.6": {
 					"name": "GLM-4.6 (via Z-AI)",
+				},
+				"zai-coding-plan/glm-4.7": {
+					"name": "GLM-4.7 Coding Plan (via Z-AI)"
 				}
 			},
 			"options": {
diff --git a/home-manager/services/cliproxyapi/default.nix b/home-manager/services/cliproxyapi/default.nix
index 3f40f77af..4edda3161 100644
--- a/home-manager/services/cliproxyapi/default.nix
+++ b/home-manager/services/cliproxyapi/default.nix
@@ -1,6 +1,12 @@
 { pkgs, ... }:
 let
   inherit (pkgs) lib;
+
+  # Create start script with paths substituted at build time
+  startScript = pkgs.replaceVars ./scripts/start.sh {
+    aws = "${pkgs.awscli2}/bin/aws";
+    sed = "${pkgs.gnused}/bin/sed";
+  };
 in
 {
   # Main cliproxyapi service
@@ -9,7 +15,7 @@ in
     config = {
       ProgramArguments = [
         "${pkgs.bash}/bin/bash"
-        "${./scripts/start.sh}"
+        "${startScript}"
       ];
       Environment = {
         HOME = "/Users/shunkakinoki";
@@ -17,6 +23,7 @@ in
           lib.makeBinPath [
             pkgs.gnused
             pkgs.coreutils
+            pkgs.awscli2
           ]
         }:/opt/homebrew/bin:/usr/local/bin:/usr/bin";
       };
@@ -38,9 +45,11 @@ in
         lib.makeBinPath [
           pkgs.gnused
           pkgs.bash
+          pkgs.coreutils
+          pkgs.awscli2
         ]
       }";
-      ExecStart = "${pkgs.bash}/bin/bash ${./scripts/start.sh}";
+      ExecStart = "${pkgs.bash}/bin/bash ${startScript}";
       Restart = "always";
       RestartSec = 3;
     };
diff --git a/home-manager/services/cliproxyapi/scripts/start.sh b/home-manager/services/cliproxyapi/scripts/start.sh
index 1220c2452..ea9cc2aa0 100755
--- a/home-manager/services/cliproxyapi/scripts/start.sh
+++ b/home-manager/services/cliproxyapi/scripts/start.sh
@@ -5,7 +5,8 @@ set -euo pipefail
 CONFIG_DIR="$HOME/.cli-proxy-api"
 TEMPLATE="$CONFIG_DIR/config.template.yaml"
 CONFIG="$CONFIG_DIR/config.yaml"
-ENV_FILE="$HOME/dotfiles/.env"
+# Use explicit path since $HOME may not be set correctly in launchd context
+ENV_FILE="${HOME:-/Users/shunkakinoki}/dotfiles/.env"
 
 # Source .env file to get API keys
 if [ -f "$ENV_FILE" ]; then
@@ -26,14 +27,34 @@ export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY
 
 # Generate config from template with secrets injected
 if [ -f "$TEMPLATE" ]; then
-  sed \
+  @sed@ \
     -e "s|__OPENROUTER_API_KEY__|${OPENROUTER_API_KEY:-}|g" \
     -e "s|__CLIPROXY_MANAGEMENT_PASSWORD__|${CLIPROXY_MANAGEMENT_PASSWORD:-}|g" \
     -e "s|__ZAI_API_KEY__|${ZAI_API_KEY:-}|g" \
+    -e "s|__AMP_UPSTREAM_API_KEY__|${AMP_UPSTREAM_API_KEY:-}|g" \
     "$TEMPLATE" >"$CONFIG"
   # Also copy to objectstore config location (cliproxyapi uses this for persistence)
   mkdir -p "$CONFIG_DIR/objectstore/config"
   cp "$CONFIG" "$CONFIG_DIR/objectstore/config/config.yaml"
+
+  # Upload config to S3 to ensure backup is always correct
+  # This prevents corrupted configs from persisting across restarts
+  if [ -n "${OBJECTSTORE_ENDPOINT:-}" ] && [ -n "${OBJECTSTORE_ACCESS_KEY:-}" ]; then
+    echo "Uploading config to S3 backup..." >&2
+    if AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \
+      AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \
+      @aws@ s3 cp \
+      --endpoint-url="${OBJECTSTORE_ENDPOINT}" \
+      --no-progress \
+      "$CONFIG" \
+      "s3://cliproxyapi/config/config.yaml" 2>&1; then
+      echo "✅ Config backup uploaded" >&2
+    else
+      echo "⚠️  Config backup failed (continuing anyway)" >&2
+    fi
+  else
+    echo "⚠️  S3 config backup skipped: missing credentials" >&2
+  fi
 fi
 
 # Change to config dir so logs are created there