Skip to content

fix(clawdbot): inject cliproxy apiKey via activation script #615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Jan 18, 2026
Merged

fix(clawdbot): inject cliproxy apiKey via activation script #615

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions home-manager/modules/clawdbot/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,23 @@ lib.mkIf (!env.isCI) {
''
);

# Inject cliproxy API key into clawdbot.json (apiKeyFile not supported upstream)
home.activation.clawdbotCliproxyKey = lib.mkIf (lib ? hm && lib.hm ? dag && host.isKyber) (
lib.hm.dag.entryAfter [ "clawdbotSecrets" "clawdbotConfigFiles" ] ''
KEY_FILE="${clawdbotDir}/cliproxy-key"
CONFIG_FILE="${homeDir}/.clawdbot/clawdbot.json"
if [ -f "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
# Inject apiKey into models.providers.cliproxy
${pkgs.jq}/bin/jq --arg key "$KEY" \
'.models.providers.cliproxy.apiKey = $key' \
"$CONFIG_FILE" > "$CONFIG_FILE.tmp" && \
${pkgs.coreutils}/bin/mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
echo "Injected cliproxy API key into clawdbot config"
fi
Comment on lines +53 to +61

@gemini-code-assist gemini-code-assist Bot Jan 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This script block can be made more robust and correct. Currently, it reports success even if the mv command fails, and it doesn't handle empty key files. I suggest the following improvements:

  1. Check for non-empty key file: Use [ -s "$KEY_FILE" ] instead of [ -f "$KEY_FILE" ] to prevent injecting an empty API key if extract-secrets.sh doesn't find a key.
  2. Use mktemp: Create a secure temporary file to avoid issues with stale or conflicting temporary files.
  3. Correct Error Handling: Ensure the success message is only printed if the entire operation succeeds, and provide an error message otherwise. This also includes cleaning up the temporary file on failure.
      if [ -s "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
        KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
        TMP_FILE=$(${pkgs.coreutils}/bin/mktemp)
        # Inject apiKey into models.providers.cliproxy
        if ${pkgs.jq}/bin/jq --arg key "$KEY" \
          '.models.providers.cliproxy.apiKey = $key' \
          "$CONFIG_FILE" > "$TMP_FILE" && \
          ${pkgs.coreutils}/bin/mv "$TMP_FILE" "$CONFIG_FILE"; then
          echo "Injected cliproxy API key into clawdbot config"
        else
          echo "Error: Failed to inject cliproxy API key into clawdbot config." >&2
          ${pkgs.coreutils}/bin/rm -f "$TMP_FILE"
        fi
      fi

Comment on lines +53 to +61

@coderabbitai coderabbitai Bot Jan 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Guard against empty key + avoid false “Injected” logs.

If the key file exists but is empty (or jq fails), the script will overwrite the config with an empty apiKey and still print success, which can silently break authentication. Consider requiring a non-empty key and chaining the success log to the jq/mv pipeline.

🔧 Suggested fix 
-      if [ -f "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
-        KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
-        # Inject apiKey into models.providers.cliproxy
-        ${pkgs.jq}/bin/jq --arg key "$KEY" \
-          '.models.providers.cliproxy.apiKey = $key' \
-          "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && \
-          ${pkgs.coreutils}/bin/mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
-        echo "Injected cliproxy API key into clawdbot config"
-      fi
+      if [ -f "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
+        KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
+        if [ -n "$KEY" ]; then
+          # Inject apiKey into models.providers.cliproxy
+          ${pkgs.jq}/bin/jq --arg key "$KEY" \
+            '.models.providers.cliproxy.apiKey = $key' \
+            "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && \
+            ${pkgs.coreutils}/bin/mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" && \
+            echo "Injected cliproxy API key into clawdbot config"
+        else
+          echo "cliproxy key is empty; skipping injection"
+        fi
+      fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if [ -f "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
# Inject apiKey into models.providers.cliproxy
${pkgs.jq}/bin/jq --arg key "$KEY" \
'.models.providers.cliproxy.apiKey = $key' \
"$CONFIG_FILE" > "$CONFIG_FILE.tmp" && \
${pkgs.coreutils}/bin/mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
echo "Injected cliproxy API key into clawdbot config"
fi
if [ -f "$KEY_FILE" ] && [ -f "$CONFIG_FILE" ]; then
KEY=$(${pkgs.coreutils}/bin/cat "$KEY_FILE" | ${pkgs.coreutils}/bin/tr -d '\n')
if [ -n "$KEY" ]; then
# Inject apiKey into models.providers.cliproxy
${pkgs.jq}/bin/jq --arg key "$KEY" \
'.models.providers.cliproxy.apiKey = $key' \
"$CONFIG_FILE" > "$CONFIG_FILE.tmp" && \
${pkgs.coreutils}/bin/mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" && \
echo "Injected cliproxy API key into clawdbot config"
else
echo "cliproxy key is empty; skipping injection"
fi
fi
🤖 Prompt for AI Agents 
In `@home-manager/modules/clawdbot/default.nix` around lines 53 - 61, The script
currently reads KEY from KEY_FILE then unconditionally runs jq to set
.models.providers.cliproxy.apiKey and echoes success; fix this by validating the
KEY is non-empty (test -n "$KEY" after KEY is assigned) and aborting/ skipping
injection if empty, and ensure the echo "Injected cliproxy API key into clawdbot
config" only runs when the jq command and subsequent mv both succeed (i.e.,
chain the jq -> mv pipeline and only print on its success). Use the existing
KEY_FILE, CONFIG_FILE, KEY variable and the jq/mv pipeline to implement these
checks so the config is not overwritten with an empty key and the success log
reflects true success.

''
);

# Inject gateway token into clawdbot.json for remote mode (tokenFile not supported upstream)
home.activation.clawdbotRemoteToken = lib.mkIf (lib ? hm && lib.hm ? dag && !host.isKyber) (
lib.hm.dag.entryAfter [ "clawdbotSecrets" "clawdbotConfigFiles" ] ''
Expand Down
Loading