fix(cliproxyapi): improve legacy service configuration and documentation - #456
Conversation
…rom auth directory watch paths
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThis change restructures CLIProxyAPI's authentication and configuration handling by introducing R2 object storage as the primary auth file source during service startup, disabling dotfiles-based syncing to prevent circular loops, updating API key configuration schema, and establishing comprehensive service documentation. Changes
Sequence DiagramsequenceDiagram
participant Service as CLIProxyAPI Service
participant Cache as Local Auth Cache
participant R2 as R2 Object Storage
participant Git as Git Dotfiles
participant Config as Config Generator
Note over Service,Git: Service Startup Flow (New)
Service->>R2: Check OBJECTSTORE_ENDPOINT<br/>OBJECTSTORE_ACCESS_KEY
alt R2 Credentials Present
R2-->>Cache: Sync from s3://cliproxyapi/auths/
R2-->>Cache: Sync from s3://cliproxyapi/backup/auths/
Note over Cache: Auth files synced from R2
else R2 Unavailable or Empty
Service->>Git: Check local git-tracked dotfiles
alt Dotfiles Contain Auth
Git-->>Cache: Bootstrap auth files
Note over Cache: Auth files bootstrapped from dotfiles
end
end
Note over Service,Config: Config Generation (Existing)
Service->>Config: Generate config from template
Config->>R2: Persist config to objectstore
Note over R2: Config persisted
Service->>Service: Start CLIProxyAPI
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRThis PR enhances the cliproxyapi service with comprehensive documentation and improves the start script with proper rsync path variable substitution. It refactors the authentication file syncing to remove unnecessary root directory sync while preserving OAuth token functionality. What changed?
Description generated by Mesa. Update settings |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="home-manager/services/cliproxyapi/default.nix">
<violation number="1" location="home-manager/services/cliproxyapi/default.nix:94">
P2: The comment documents that dotfiles is excluded to prevent circular sync loops, but this exclusion was only applied to the macOS launchd configuration. The Linux systemd path watcher (`systemd.user.paths.cliproxyapi-backup`) still includes `%h/dotfiles/objectstore/auths` in its `PathChanged` list, which could cause the same circular sync issue on Linux systems.</violation>
</file>
Reply to cubic to teach it or ask questions. Tag @cubic-dev-ai to re-run a review.
| }:/opt/homebrew/bin:/usr/local/bin:/usr/bin"; | ||
| }; | ||
| # Watch auth directories for changes - triggers sync immediately | ||
| # NOTE: dotfiles is excluded to prevent circular sync loops |
There was a problem hiding this comment.
P2: The comment documents that dotfiles is excluded to prevent circular sync loops, but this exclusion was only applied to the macOS launchd configuration. The Linux systemd path watcher (systemd.user.paths.cliproxyapi-backup) still includes %h/dotfiles/objectstore/auths in its PathChanged list, which could cause the same circular sync issue on Linux systems.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/services/cliproxyapi/default.nix, line 94:
<comment>The comment documents that dotfiles is excluded to prevent circular sync loops, but this exclusion was only applied to the macOS launchd configuration. The Linux systemd path watcher (`systemd.user.paths.cliproxyapi-backup`) still includes `%h/dotfiles/objectstore/auths` in its `PathChanged` list, which could cause the same circular sync issue on Linux systems.</comment>
<file context>
@@ -90,9 +91,9 @@ in
}:/opt/homebrew/bin:/usr/local/bin:/usr/bin";
};
# Watch auth directories for changes - triggers sync immediately
+ # NOTE: dotfiles is excluded to prevent circular sync loops
WatchPaths = [
"${homeDir}/.cli-proxy-api/objectstore/auths"
</file context>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly improves the cliproxyapi service by adding comprehensive documentation and refining the authentication file syncing logic. The changes to prevent circular sync loops are well-implemented. My review focuses on enhancing the clarity and consistency of the new documentation and improving the robustness of the shell scripts. I've suggested fixes for a broken diagram in the README, recommended using configuration variables instead of hardcoded values in the start script, and pointed out opportunities to simplify shell script logic.
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | ||
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | ||
| @aws@ s3 sync \ | ||
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | ||
| --no-progress \ | ||
| "s3://cliproxyapi/auths/" \ | ||
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 auths/" >&2 || true | ||
|
|
||
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | ||
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | ||
| @aws@ s3 sync \ | ||
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | ||
| --no-progress \ | ||
| "s3://cliproxyapi/backup/auths/" \ | ||
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true |
There was a problem hiding this comment.
The S3 bucket name cliproxyapi is hardcoded in the s3 sync commands. The script already exports the OBJECTSTORE_BUCKET environment variable, which should be used here to make the script more configurable and consistent. This will allow users to change the bucket name via the .env file without modifying the script.
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | |
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | |
| @aws@ s3 sync \ | |
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | |
| --no-progress \ | |
| "s3://cliproxyapi/auths/" \ | |
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 auths/" >&2 || true | |
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | |
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | |
| @aws@ s3 sync \ | |
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | |
| --no-progress \ | |
| "s3://cliproxyapi/backup/auths/" \ | |
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true | |
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | |
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | |
| @aws@ s3 sync \ | |
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | |
| --no-progress \ | |
| "s3://${OBJECTSTORE_BUCKET}/auths/" \ | |
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 auths/" >&2 || true | |
| AWS_ACCESS_KEY_ID="${OBJECTSTORE_ACCESS_KEY}" \ | |
| AWS_SECRET_ACCESS_KEY="${OBJECTSTORE_SECRET_KEY}" \ | |
| @aws@ s3 sync \ | |
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | |
| --no-progress \ | |
| "s3://${OBJECTSTORE_BUCKET}/backup/auths/" \ | |
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true |
| │ ┌────────────┐ │ │ ┌────────────────────────┐ │ | ||
| │ │ backup/ │◄─┼──────┤ │ OAuth tokens stored │ │ | ||
| │ └────────────┘ │ │ │ - claude-*.json │ │ | ||
| └──────────────────┘ │ │ - codex-*.json │ │ |
There was a problem hiding this comment.
The ASCII art diagram for the data flow appears to be broken on this line, which harms readability. The R2 Storage box closing └──────────────────┘ is misaligned with the rest of the diagram, causing a visual glitch.
Additionally, the diagram might be slightly misleading:
- The arrow from
backup/on line 75 seems to point toOAuth tokens storedinstead ofobjectstore/auths/. According to the description, both primary and backup R2 locations sync toobjectstore/auths/.
Please review and fix the diagram's formatting and arrows to accurately reflect the data flow described in the text.
| - Runs on service start | ||
| - Pulls auth files from R2 | ||
| - Bootstraps from dotfiles if needed | ||
| - Syncs to OAuth directory |
There was a problem hiding this comment.
The term "OAuth directory" is used here, but the rest of the documentation consistently refers to objectstore/auths/. For consistency and clarity, it would be better to use the actual directory name.
| - Syncs to OAuth directory | |
| - Syncs to objectstore/auths |
|
|
||
| ## Notes | ||
|
|
||
| - **Auth file naming:** Must match pattern `*-shunkakinoki@gmail.com.json` or `*-shunkakinoki_gmail_com.json` |
There was a problem hiding this comment.
The example auth file name includes a specific email address (shunkakinoki@gmail.com). This should be generalized to be more useful for other users of this documentation. Using a placeholder like <user> or <user_identifier> would be more appropriate.
| - **Auth file naming:** Must match pattern `*-shunkakinoki@gmail.com.json` or `*-shunkakinoki_gmail_com.json` | |
| - **Auth file naming:** Must match pattern `*-<user>@gmail.com.json` or `*-<user>_gmail_com.json` |
| "$AUTH_DIR/" 2>/dev/null && echo "✅ Pulled from R2 backup/auths/" >&2 || true | ||
|
|
||
| # Bootstrap from git-tracked dotfiles if objectstore is empty | ||
| if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then |
There was a problem hiding this comment.
The check for whether the auth directory is empty can be simplified. Since mkdir -p "$AUTH_DIR" is executed on line 33, the directory is guaranteed to exist. Therefore, the [ ! -d "$AUTH_DIR" ] part of the condition is redundant. Simplifying the check will make the script cleaner.
| if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then | |
| if [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: "openrouter" | ||
| base-url: "https://openrouter.ai/api/v1" | ||
| api-keys: | ||
| - "__OPENROUTER_API_KEY__" | ||
| api-key-entries: | ||
| - api-key: "__OPENROUTER_API_KEY__" |
There was a problem hiding this comment.
api-keys for openai-compatibility auth
The openai-compatibility provider config previously used api-keys (list of strings), but this change switches to api-key-entries objects. If CLIProxyAPI only recognizes api-keys (as the earlier config did), it will ignore these entries and load no API keys for OpenRouter/Z-AI, causing all requests to those providers to be unauthenticated and fail (401/403). This only impacts environments using those providers; consider reverting to api-keys or confirming that api-key-entries is actually supported by the cliproxyapi config schema.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR enhances the cliproxyapi service configuration with comprehensive documentation, fixes rsync path substitution, and prevents circular sync loops by refactoring the authentication file synchronization flow.
- Adds rsync path to Nix variable substitution in start.sh for proper environment variable handling
- Removes dotfiles directory from WatchPaths to prevent circular sync loops during auth file monitoring
- Refactors OpenAI compatibility provider configuration from simple
api-keyslist to structuredapi-key-entriesformat - Adds comprehensive README documentation covering architecture, auth management flow, and troubleshooting
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| home-manager/services/cliproxyapi/scripts/start.sh | Adds AUTH_DIR variable and R2 auth file sync logic with bootstrap fallback to dotfiles; adds rsync placeholder for proper path substitution |
| home-manager/services/cliproxyapi/scripts/backup-auth.sh | Comments out dotfiles-to-cache sync to prevent circular loops while maintaining dotfiles as write-only backup destination |
| home-manager/services/cliproxyapi/default.nix | Adds rsync path substitution to startScript and removes dotfiles path from WatchPaths to prevent circular sync loops |
| home-manager/services/cliproxyapi/README.md | New comprehensive documentation covering service architecture, auth file management flow, directory structure, environment variables, usage examples, and recovery scenarios |
| config/cliproxyapi/config.yaml | Refactors openrouter and z-ai providers from api-keys list format to api-key-entries object format for consistency; adds commented model-mappings example for ampcode |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @aws@ s3 sync \ | ||
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | ||
| --no-progress \ | ||
| "s3://cliproxyapi/auths/" \ |
There was a problem hiding this comment.
The bucket name is hardcoded as "cliproxyapi" in the S3 URIs, but OBJECTSTORE_BUCKET is exported on line 25. This creates an inconsistency where changing the bucket name via environment variable would not affect the actual bucket being accessed. Consider using the OBJECTSTORE_BUCKET variable in the S3 URIs instead of hardcoding, like "s3://${OBJECTSTORE_BUCKET}/auths/".
| @aws@ s3 sync \ | ||
| --endpoint-url="${OBJECTSTORE_ENDPOINT}" \ | ||
| --no-progress \ | ||
| "s3://cliproxyapi/backup/auths/" \ |
There was a problem hiding this comment.
The bucket name is hardcoded as "cliproxyapi" in the S3 URI, but OBJECTSTORE_BUCKET is set in the environment (line 25 of start.sh). This creates an inconsistency where changing the bucket name via environment variable would not affect the actual bucket being accessed. Consider using the OBJECTSTORE_BUCKET variable instead of hardcoding, like "s3://${OBJECTSTORE_BUCKET}/backup/auths/".
| - Runs on service start | ||
| - Pulls auth files from R2 | ||
| - Bootstraps from dotfiles if needed | ||
| - Syncs to OAuth directory |
There was a problem hiding this comment.
The documentation states "Syncs to OAuth directory" but the actual start.sh script does not perform any sync to a separate OAuth directory. The script pulls from R2 (lines 36-50), bootstraps from dotfiles if needed (lines 52-58), generates config (lines 63-93), and starts the cliproxyapi binary (lines 95-106). There is no OAuth directory sync step.
| - Syncs to OAuth directory | |
| - Generates config |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
home-manager/services/cliproxyapi/default.nix (1)
105-116: Add same dotfiles exclusion to Linux systemd configuration.The Darwin launchd configuration (line 94-98) explicitly excludes
dotfiles/objectstore/authsfrom WatchPaths with a comment noting this prevents circular sync loops. The Linux systemdPathChanged(lines 108-112) still includes%h/dotfiles/objectstore/auths, which contradicts this decision. The README documents that watching and writing to dotfiles simultaneously previously caused infinite sync loops. Remove%h/dotfiles/objectstore/authsfrom the systemd PathChanged list to match the Darwin implementation and prevent circular sync loops on Linux.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
config/cliproxyapi/config.yamlhome-manager/services/cliproxyapi/README.mdhome-manager/services/cliproxyapi/default.nixhome-manager/services/cliproxyapi/scripts/backup-auth.shhome-manager/services/cliproxyapi/scripts/start.sh
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{js,jsx,ts,tsx,json,jsonc,md}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Use Biome for code formatting as configured in biome.json
Files:
home-manager/services/cliproxyapi/README.md
**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.nix: Use nixfmt for formatting all Nix files
Document complex configurations with comments in Nix files
**/*.nix: Use 2 spaces for indentation in Nix files
Keep line length under 100 characters in Nix files
Sort attribute sets alphabetically in Nix files
Use consistent spacing around operators in Nix files
Format lists and sets consistently in Nix filesUse treefmt.toml for formatting Nix files
**/*.nix: UsemkOptionfor configurable options in Nix modules
Implement proper typing for all options in Nix modules
Follow the Nix expression language style guide
Files:
home-manager/services/cliproxyapi/default.nix
**/default.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use
default.nixfiles for module exports
Files:
home-manager/services/cliproxyapi/default.nix
home-manager/services/*/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations should be located in
home-manager/services/<name>/with proper service definitions and correct dependency handling
Files:
home-manager/services/cliproxyapi/default.nix
home-manager/services/**/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations must include proper service definitions, handle dependencies correctly, and document service parameters
Files:
home-manager/services/cliproxyapi/default.nix
home-manager/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
home-manager/**/*.nix: Use typed options whenever possible in Nix configurations
Document all configuration options in Nix modules and programs
Follow home-manager's module structure and keep configurations modular
Use proper indentation and formatting in Nix configuration files
Files:
home-manager/services/cliproxyapi/default.nix
home-manager/services/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/nix.mdc)
Service configurations in
home-manager/services/should follow systemd service conventions, include proper service dependencies, and have clear documentation for service parameters
Files:
home-manager/services/cliproxyapi/default.nix
**/*.{sh,bash}
📄 CodeRabbit inference engine (CLAUDE.md)
Use shfmt with 2-space indentation for shell scripts
**/*.{sh,bash}: Use 2 spaces for indentation in shell scripts
Add proper shebang lines to shell scripts
Follow shellcheck recommendations in shell scripts
Document complex commands in shell scripts
Use consistent variable naming in shell scripts
Files:
home-manager/services/cliproxyapi/scripts/start.shhome-manager/services/cliproxyapi/scripts/backup-auth.sh
**/*.{json,yaml,yml,toml}
📄 CodeRabbit inference engine (.cursor/rules/formatting.mdc)
**/*.{json,yaml,yml,toml}: Use consistent indentation (2 spaces) in configuration files
Sort keys alphabetically when possible in configuration files
Use clear, descriptive names in configuration files
Files:
config/cliproxyapi/config.yaml
**/*.{yaml,yml,toml}
📄 CodeRabbit inference engine (.cursor/rules/formatting.mdc)
Add comments for complex configurations
Files:
config/cliproxyapi/config.yaml
🧠 Learnings (6)
📚 Learning: 2025-11-25T09:34:40.062Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-11-25T09:34:40.062Z
Learning: Document all major changes in Nix configurations
Applied to files:
home-manager/services/cliproxyapi/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/programs/**/*.nix : Follow program-specific best practices in program configuration files
Applied to files:
home-manager/services/cliproxyapi/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/services/**/default.nix : Service configurations must include proper service definitions, handle dependencies correctly, and document service parameters
Applied to files:
home-manager/services/cliproxyapi/default.nix
📚 Learning: 2025-11-25T09:34:40.062Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-11-25T09:34:40.062Z
Learning: Keep configurations modular across home-manager, hosts, and nix-darwin directories
Applied to files:
home-manager/services/cliproxyapi/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Follow home-manager's module structure and keep configurations modular
Applied to files:
home-manager/services/cliproxyapi/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Document all configuration options in Nix modules and programs
Applied to files:
home-manager/services/cliproxyapi/default.nix
🪛 LanguageTool
home-manager/services/cliproxyapi/README.md
[grammar] ~238-~238: Ensure spelling is correct
Context: ...tion Files ### default.nix - Defines launchd agents (macOS) or systemd services (Lin...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🪛 markdownlint-cli2 (0.18.1)
home-manager/services/cliproxyapi/README.md
18-18: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
68-68: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (16)
- GitHub Check: Agent
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Cursor Bugbot
- GitHub Check: shellcheck
- GitHub Check: shellspec
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: nix-linux
- GitHub Check: nix-darwin
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: lua-neovim
- GitHub Check: nix-nixos
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: lua-hammerspoon
- GitHub Check: lua-neovim-test
🔇 Additional comments (7)
home-manager/services/cliproxyapi/README.md (1)
1-270: Excellent comprehensive documentation!The README provides clear, thorough documentation of the service architecture, data flow, auth management, and operational procedures. The inclusion of recovery scenarios, troubleshooting steps, and detailed workflow explanations will significantly help with service maintenance and debugging.
home-manager/services/cliproxyapi/scripts/backup-auth.sh (1)
35-40: LGTM! Circular sync loop prevention implemented correctly.Disabling the dotfiles-to-cache sync in the backup script and documenting it as bootstrap-only is the right approach to prevent circular sync loops. This aligns with the architecture where dotfiles serves as write-only storage (except during initial bootstrap in start.sh).
home-manager/services/cliproxyapi/scripts/start.sh (1)
29-61: LGTM! Auth sync and bootstrap logic is well-implemented.The pre-start authentication sync flow is correctly structured:
- Pulls from primary and backup R2 locations
- Provides bootstrap fallback from dotfiles when objectstore is empty
- Uses non-fatal error handling (
|| true) appropriately- Includes clear user warnings for missing credentials
This implementation aligns well with the documented architecture in the README.
home-manager/services/cliproxyapi/default.nix (2)
11-11: LGTM! rsync path substitution added correctly.The rsync binary path is now properly substituted in the start script, enabling the bootstrap sync logic from dotfiles to AUTH_DIR.
94-98: LGTM! Clear documentation of circular sync prevention.The comment and removal of dotfiles from Darwin WatchPaths correctly prevents circular sync loops on macOS.
config/cliproxyapi/config.yaml (2)
41-43: LGTM! Model mappings example added.The commented model-mappings example provides helpful documentation for ampcode configuration.
77-78: No action needed. Theapi-key-entriesschema is the correct and current format for cliproxyapi's openai-compatibility providers. The legacyapi-keysformat (bare strings) is deprecated and automatically converted toapi-key-entriesby cliproxyapi on load. This is not a breaking change—it's the preferred configuration format.Likely an incorrect or invalid review comment.
| ``` | ||
| ~/.cli-proxy-api/ | ||
| ├── config.yaml # Generated config (from template) | ||
| ├── config.template.yaml # Template with placeholders (symlink) | ||
| └── objectstore/ | ||
| ├── config/ | ||
| │ └── config.yaml # Cloud-synced config | ||
| └── auths/ # Auth files (cliproxyapi reads from here) | ||
| ├── claude-*.json # OAuth tokens for Claude | ||
| ├── codex-*.json # OAuth tokens for Codex | ||
| └── antigravity-*.json # OAuth tokens for other services | ||
|
|
||
| ~/dotfiles/objectstore/auths/ # Git-tracked backup (write-only) | ||
| ~/.ccs/cliproxy/auth/ # CCS auth directory (two-way sync) | ||
|
|
||
| R2 Storage (Cloudflare): | ||
| ├── s3://cliproxyapi/auths/ # Primary cloud storage | ||
| ├── s3://cliproxyapi/backup/auths/ # Redundant backup | ||
| └── s3://cliproxyapi/config/ # Config backup | ||
| ``` |
There was a problem hiding this comment.
Add language specifier to fenced code block.
Add a language identifier (e.g., text or leave empty) to improve Markdown rendering consistency.
🔎 Proposed fix
-```
+```text
~/.cli-proxy-api/🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
18-18: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In home-manager/services/cliproxyapi/README.md around lines 18 to 37, the fenced
code block showing the directory tree lacks a language specifier which can
affect Markdown rendering; edit the opening fence to include a language
identifier such as "text" (i.e., change ``` to ```text) so the block is
consistently rendered, then save the file.
| ``` | ||
| ┌──────────────────┐ | ||
| │ R2 Storage │ | ||
| │ ┌────────────┐ │ ┌──────────────────────────────┐ | ||
| │ │ auths/ │◄─┼──────┤ objectstore/auths/ │ | ||
| │ └────────────┘ │ │ (cliproxyapi reads here) │ | ||
| │ ┌────────────┐ │ │ ┌────────────────────────┐ │ | ||
| │ │ backup/ │◄─┼──────┤ │ OAuth tokens stored │ │ | ||
| │ └────────────┘ │ │ │ - claude-*.json │ │ | ||
| └──────────────────┘ │ │ - codex-*.json │ │ | ||
| │ │ - antigravity-*.json │ │ | ||
| │ └────────────────────────┘ │ | ||
| └──────────────────────────────┘ | ||
| │ | ||
| ├─────► ccs/auth/ | ||
| └─────► dotfiles/ (git backup) | ||
| │ | ||
| └─► Bootstrap only | ||
| ``` |
There was a problem hiding this comment.
Add language specifier to fenced code block.
Add a language identifier (e.g., text or leave empty) for the ASCII diagram.
🔎 Proposed fix
-```
+```text
┌──────────────────┐📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` | |
| ┌──────────────────┐ | |
| │ R2 Storage │ | |
| │ ┌────────────┐ │ ┌──────────────────────────────┐ | |
| │ │ auths/ │◄─┼──────┤ objectstore/auths/ │ | |
| │ └────────────┘ │ │ (cliproxyapi reads here) │ | |
| │ ┌────────────┐ │ │ ┌────────────────────────┐ │ | |
| │ │ backup/ │◄─┼──────┤ │ OAuth tokens stored │ │ | |
| │ └────────────┘ │ │ │ - claude-*.json │ │ | |
| └──────────────────┘ │ │ - codex-*.json │ │ | |
| │ │ - antigravity-*.json │ │ | |
| │ └────────────────────────┘ │ | |
| └──────────────────────────────┘ | |
| │ | |
| ├─────► ccs/auth/ | |
| └─────► dotfiles/ (git backup) | |
| │ | |
| └─► Bootstrap only | |
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
68-68: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
home-manager/services/cliproxyapi/README.md around lines 68 to 86: the fenced
code block containing the ASCII diagram lacks a language specifier; update the
opening fence from ``` to ```text (or another appropriate identifier like ```)
so the block is marked as plain text, leaving the diagram contents unchanged and
keeping the closing fence as-is.
Summary
This PR enhances the cliproxyapi service with comprehensive documentation and improves the start script with proper rsync path variable substitution. It refactors the authentication file syncing to remove unnecessary root directory sync while preserving OAuth token functionality.
Changes
Files Modified
config/cliproxyapi/config.yaml- Enhanced API configurationhome-manager/services/cliproxyapi/README.md- New comprehensive documentationhome-manager/services/cliproxyapi/default.nix- Updated module configurationhome-manager/services/cliproxyapi/scripts/backup-auth.sh- Enhanced backup logichome-manager/services/cliproxyapi/scripts/start.sh- Added rsync path substitutionType of Change
Note
Strengthens cliproxyapi’s auth handling and docs with objectstore-centric workflows and safer sync.
start.shnow pulls auths from R2 (auths/+backup/auths/) before launch and bootstraps fromdotfilesonly if empty; backup script stops reading from dotfiles to avoid loops and still merges CCS tokensdotfilesfrom launchdWatchPaths, preventing circular sync; watchers now monitor onlyobjectstore/authsand~/.ccs/cliproxy/authapi-key-entriesinconfig.yaml; adds commentedampcode.model-mappingsexamplersyncpath for scripts; updates PATHs accordinglyREADME.mddescribing architecture, flows, and recoveryWritten by Cursor Bugbot for commit fe285e8. Configure here.
Summary by cubic
Improves cliproxyapi reliability and docs. Startup now pulls auth files from R2, removes circular sync loops, and keeps OAuth tokens working.
Bug Fixes
New Features
Written for commit fe285e8. Summary will update automatically on new commits.