fix: use activation script for gemini settings to allow ruler writes - #657
fix: use activation script for gemini settings to allow ruler writes#657shunkakinoki wants to merge 40 commits into
Conversation
…ript - Added `git-ai` dependency to `Cargo.toml` from the main branch of the GitHub repository. - Updated `install-cargo-globals.sh` to support parsing of git dependencies and handle version strings more robustly. - Improved the logic for installing dependencies, including support for git repositories with branch, tag, and revision options. - Modified `default.nix` to update the pnpmDepsHash for clawdbot. - Enhanced `upgrade-overlays.sh` to dynamically detect platform and build configuration for better compatibility. - Updated tests in `cargo_globals_spec.sh` to verify support for new dependency formats and installation methods.
…d git-ai checkpoint hooks
…tra-openai-models.yaml
…-4-7 in _ocxe_function.fish and _ocxeh_function.fish
…t from homebrew.nix
- Use tokenFile instead of token for channels.telegram (schema requirement) - Simplify hydrate script to only substitute necessary placeholders
Flake lock file updates:
• Updated input 'nix-clawdbot':
'github:clawdbot/nix-clawdbot/fbbf80bc829180cc1e7c76bd2565de96e624d4e8?narHash=sha256-3tmn4wU1XBmaL7VnZQrtBkQZcth3O%2ButruKCZ6xEUYc%3D' (2026-01-22)
→ 'github:clawdbot/nix-clawdbot/aa60a29d387174c765893b135286714e17d0e85e?narHash=sha256-LkYuoCR07k2gA16XD7G/oyeic3jC5x8t49spvGHHiEo%3D' (2026-01-23)
- Change gemini settings.json from symlink to copied file - Only copy if file doesn't exist, allowing ruler to modify it - Restore telegram channel config in clawdbot template
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Caution Review failedThe pull request is closed. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThe PR integrates git-ai checkpoint hooks into multiple LLM tools (Claude, Gemini, Cursor), reworks Clawdbot from an external overlay to an internal configuration with hydration and systemd service, migrates model configurations from GLM-4.6 to GLM-4.7 across multiple providers, enhances Cargo dependency parsing for git-based dependencies, and adds GitHub Actions auto-merge functionality. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Possibly related PRs
Poem
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRChanged What changed?
Description generated by Mesa. Update settings |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the development environment's AI tool integration and configuration management. It addresses the writability of Gemini settings, streamlines Clawdbot's deployment and secret handling, and updates AI model definitions across several applications. Furthermore, it refines the process for installing global Rust packages, ensuring better compatibility and dependency resolution. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request primarily addresses an issue with Gemini settings to make them writable, but also includes a substantial number of dependency updates and configuration changes across various tools like clawdbot, cliproxyapi, and opencode. A significant refactoring is the removal of the nix-clawdbot flake in favor of building clawdbot from source. My review focuses on improving the robustness, security, and maintainability of the new scripts and configurations. I've identified opportunities for improvement in git dependency pinning, secret handling in shell scripts, the idempotency of activation scripts, and the logic for installing cargo packages from git sources.
| path = "lib.rs" | ||
|
|
||
| [dependencies] | ||
| git-ai = { git = "https://github.com/git-ai-project/git-ai", branch = "main" } |
There was a problem hiding this comment.
The git-ai dependency is pinned to the main branch. This can lead to non-reproducible builds as the main branch can change at any time, which is especially risky for a dependency that seems to be used in hooks and automation. It's a best practice to pin git dependencies to a specific commit hash using the rev key to ensure build stability and predictability.
| git-ai = { git = "https://github.com/git-ai-project/git-ai", branch = "main" } | |
| git-ai = { git = "https://github.com/git-ai-project/git-ai", rev = "be15ad1b43dfa2febe643e3ed81be4e801df4d09" } |
| @sed@ \ | ||
| -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \ | ||
| -e "s|__TELEGRAM_TOKEN__|${TELEGRAM_TOKEN}|g" \ | ||
| -e "s|__GATEWAY_TOKEN__|${GATEWAY_TOKEN}|g" \ | ||
| -e "s|__CHROMIUM_PATH__|${CHROMIUM_PATH}|g" \ | ||
| -e "s|__HOME__|${HOME}|g" \ | ||
| "$TEMPLATE" >"$CONFIG" |
There was a problem hiding this comment.
Using | as a delimiter in sed is risky when substituting secrets, as API keys or tokens could potentially contain this character, which would break the substitution. It's safer to use a delimiter that is less likely to appear in the secrets, such as # or / (if slashes are not expected in the values).
| @sed@ \ | |
| -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \ | |
| -e "s|__TELEGRAM_TOKEN__|${TELEGRAM_TOKEN}|g" \ | |
| -e "s|__GATEWAY_TOKEN__|${GATEWAY_TOKEN}|g" \ | |
| -e "s|__CHROMIUM_PATH__|${CHROMIUM_PATH}|g" \ | |
| -e "s|__HOME__|${HOME}|g" \ | |
| "$TEMPLATE" >"$CONFIG" | |
| @sed@ \ | |
| -e "s#__CLIPROXY_API_KEY__#${CLIPROXY_API_KEY}#g" \ | |
| -e "s#__TELEGRAM_TOKEN__#${TELEGRAM_TOKEN}#g" \ | |
| -e "s#__GATEWAY_TOKEN__#${GATEWAY_TOKEN}#g" \ | |
| -e "s#__CHROMIUM_PATH__#${CHROMIUM_PATH}#g" \ | |
| -e "s#__HOME__#${HOME}#g" \ | |
| "$TEMPLATE" >"$CONFIG" |
| if [ -n "${INSTALLED_MAP[$NAME]:-}" ]; then | ||
| echo "$NAME already installed (git), skipping" | ||
| continue | ||
| fi | ||
| echo "Installing $NAME from $GIT_URL..." | ||
| INSTALL_ARGS=(--git "$GIT_URL") | ||
| if [ -n "$REV" ]; then | ||
| INSTALL_ARGS+=(--rev "$REV") | ||
| elif [ -n "$TAG" ]; then | ||
| INSTALL_ARGS+=(--tag "$TAG") | ||
| elif [ -n "$BRANCH" ]; then | ||
| INSTALL_ARGS+=(--branch "$BRANCH") | ||
| fi | ||
| if ! cargo install "$NAME" "${INSTALL_ARGS[@]}" --locked 2>&1; then | ||
| if ! cargo install "$NAME" "${INSTALL_ARGS[@]}" 2>&1; then | ||
| echo "Failed to install $NAME from git, skipping..." | ||
| fi | ||
| fi | ||
| fi |
There was a problem hiding this comment.
The check for already-installed git dependencies is based on the version number from cargo install --list. This is unreliable for git dependencies, as the version in Cargo.toml might not change even if the underlying branch has new commits. This means the script will not update the package if the git repository is updated. To ensure the latest version from the git repository is always installed, you should use cargo install --force for git dependencies and remove the check for existing installations.
| if [ -n "${INSTALLED_MAP[$NAME]:-}" ]; then | |
| echo "$NAME already installed (git), skipping" | |
| continue | |
| fi | |
| echo "Installing $NAME from $GIT_URL..." | |
| INSTALL_ARGS=(--git "$GIT_URL") | |
| if [ -n "$REV" ]; then | |
| INSTALL_ARGS+=(--rev "$REV") | |
| elif [ -n "$TAG" ]; then | |
| INSTALL_ARGS+=(--tag "$TAG") | |
| elif [ -n "$BRANCH" ]; then | |
| INSTALL_ARGS+=(--branch "$BRANCH") | |
| fi | |
| if ! cargo install "$NAME" "${INSTALL_ARGS[@]}" --locked 2>&1; then | |
| if ! cargo install "$NAME" "${INSTALL_ARGS[@]}" 2>&1; then | |
| echo "Failed to install $NAME from git, skipping..." | |
| fi | |
| fi | |
| fi | |
| # Use --force to ensure git dependencies are updated to the latest commit from the specified branch/rev. | |
| echo "Installing $NAME from $GIT_URL..." | |
| INSTALL_ARGS=(--git "$GIT_URL") | |
| if [ -n "$REV" ]; then | |
| INSTALL_ARGS+=(--rev "$REV") | |
| elif [ -n "$TAG" ]; then | |
| INSTALL_ARGS+=(--tag "$TAG") | |
| elif [ -n "$BRANCH" ]; then | |
| INSTALL_ARGS+=(--branch "$BRANCH") | |
| fi | |
| if ! cargo install --force "$NAME" "${INSTALL_ARGS[@]}" --locked 2>&1; then | |
| if ! cargo install --force "$NAME" "${INSTALL_ARGS[@]}" 2>&1; then | |
| echo "Failed to install $NAME from git, skipping..." | |
| fi | |
| fi |
| "tokenFile": "__HOME__/.config/clawdbot/telegram-token", | ||
| "groups": { | ||
| "*": {"requireMention": false}, | ||
| "-1003612372477": {"requireMention": false, "enabled": true} |
There was a problem hiding this comment.
The Telegram group ID "-1003612372477" is hardcoded in this template. If this value is user-specific or could change between environments, it would be better to treat it as a configurable parameter. Consider replacing it with a placeholder, like __TELEGRAM_GROUP_ID__, and substituting it in the hydrate.sh script, similar to how other secrets and configuration values are handled. This would make the template more generic and easier to manage.
| home.activation.geminiSettings = lib.hm.dag.entryAfter [ "writeBoundary" ] '' | ||
| mkdir -p "$HOME/.gemini" | ||
| if [ ! -f "$HOME/.gemini/settings.json" ]; then | ||
| $DRY_RUN_CMD cp ${geminiSettingsSource} "$HOME/.gemini/settings.json" | ||
| $DRY_RUN_CMD chmod 644 "$HOME/.gemini/settings.json" | ||
| fi | ||
| ''; |
There was a problem hiding this comment.
The activation script for geminiSettings only copies the file if it doesn't exist. As noted in the PR description, this doesn't handle the migration from an existing symlink automatically. To make the migration smoother and the script more robust, consider explicitly checking for and removing a symlink if it exists. This will make the activation script idempotent and handle the transition seamlessly for users.
home.activation.geminiSettings = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
TARGET_FILE="$HOME/.gemini/settings.json"
mkdir -p "$(dirname "$TARGET_FILE")"
if [ -L "$TARGET_FILE" ]; then
$DRY_RUN_CMD rm -f "$TARGET_FILE"
fi
if [ ! -f "$TARGET_FILE" ]; then
$DRY_RUN_CMD cp ${geminiSettingsSource} "$TARGET_FILE"
$DRY_RUN_CMD chmod 644 "$TARGET_FILE"
fi
'';
There was a problem hiding this comment.
Pull request overview
This PR refactors several tooling integrations (Gemini, Cursor, Clawdbot, cargo globals, LLM configs) to work better with local state and git-ai checkpoints, and drops the external nix-clawdbot overlay in favor of an in-repo Clawdbot build and config.
Changes:
- Replace Gemini’s settings symlink with a home-manager activation script that copies a writable settings.json, and add git-ai checkpoints for Gemini, Cursor, and Claude tool/file hooks.
- Remove the nix-clawdbot flake overlay and introduce a custom Clawdbot derivation plus a
hydrate.shgateway script and template-driven configuration, along with updated secret handling and Telegram channel config. - Improve cargo globals installation to support both version and git dependencies and to build reliably on macOS (OpenSSL/libiconv/SDKROOT), and wire in git-ai as a Rust dependency and extra LLM model config.
Notable issues (see inline comments for details):
scripts/upgrade-overlays.shstill assumes the old Clawdbot overlay structure and apnpmDepsHashinoverlays/default.nix, which will now break the scheduled upgrade workflow.- The new
config/clawdbot/hydrate.shscript is not yet included in the shellscript coverage spec, and the coverage list still references the deletedhome-manager/modules/clawdbot/extract-secrets.sh. - The
clawdbot-gatewaysystemd user unit uses aWorkingDirectorythat is never created, so the service will fail to start on a fresh install.
Reviewed changes
Copilot reviewed 32 out of 34 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
spec/cargo_globals_spec.sh |
Updates shellspec expectations to match the new cargo-globals script behavior (type checks, .value.version, git deps). |
scripts/upgrade-overlays.sh |
Adds platform-aware nix_config selection for pnpm hash computation and still contains Clawdbot-specific overlay upgrade logic (now out of sync with overlays/default.nix). |
overlays/default.nix |
Simplifies overlays to just NUR, neovim-nightly, and a few small overrides, removing the custom Clawdbot overlay entirely. |
nix-darwin/default.nix |
Drops the Clawdbot.app installation activation script for galactica, aligning with removal of the Clawdbot overlay/app package. |
home-manager/programs/fish/functions/_zpo_function.fish |
Adds a helper to attach to the primary zellij session. |
home-manager/programs/fish/functions/_ocxeh_function.fish |
Points the headless OpenCode GLM-4.7 helper at the cliproxyapi/glm-4-7 model instead of the openrouter preset. |
home-manager/programs/fish/functions/_ocxe_function.fish |
Updates the interactive OpenCode GLM-4.7 function to use cliproxyapi/glm-4-7 for both default and run modes. |
home-manager/programs/fish/default.nix |
Registers the new zpo function and reorders/extends the functions list to keep all helpers (including ocx*, pix*, ssh_add_github) loaded. |
home-manager/packages/default.nix |
Adds libiconv to the common home packages to support macOS builds. |
home-manager/modules/clawdbot/extract-secrets.sh |
Removes the old secrets-extraction script that read from .env and cliproxyapi auth; callers/tests still reference this path (see inline comment). |
home-manager/modules/clawdbot/default.nix |
Replaces the nix-clawdbot module with a custom Clawdbot build (pnpm+node), a secrets extraction activation step, and a clawdbot-gateway systemd user service driven by the new hydrate script and template. |
home-manager/modules/cargo-globals/install-cargo-globals.sh |
Extends cargo-globals install to set SDKROOT on macOS and to parse Cargo.toml dependency entries via jq (supporting string, table, and git dependencies) with smarter version reuse. |
home-manager/modules/cargo-globals/default.nix |
Injects additional OpenSSL/libiconv-related build env vars on macOS and wires in the updated install script via a home-manager activation DAG entry. |
home-manager/default.nix |
Stops importing inputs.nix-clawdbot.homeManagerModules.clawdbot, deferring entirely to the new in-tree Clawdbot module. |
flake.nix |
Drops the nix-clawdbot input and simplifies nixpkgs wiring to a single input. |
flake.lock |
Regenerates lockfile to remove nix-clawdbot and related inputs and update the pinned nixpkgs revision. |
config/pi/models.json |
Removes the z-ai/glm-4.6 model from the Pi model config, leaving GLM-4.7 as the remaining GLM entry. |
config/opencode/opencode.jsonc |
Switches default models to cliproxyapi/glm-4.7, adds CLIPROXY API key wiring, renames/normalizes GLM model IDs, and adjusts display names to clarify “local CLIProxyAPI”. |
config/llm/extra-openai-models.yaml |
Updates Claude model IDs to the new 4.5 variants and adds a glm-4.7 entry for use via cliproxyapi. |
config/llm/default_model.txt |
Introduces a default llm model file selecting glm-4.7. |
config/llm/default.nix |
Symlinks extra-openai-models.yaml and the new default_model.txt into platform-appropriate locations for the io.datasette.llm tool on macOS and Linux. |
config/gemini/settings.json |
Adds Gemini tool hooks that call git-ai checkpoint gemini before and after write/replace tools. |
config/gemini/default.nix |
Replaces a symlinked Gemini settings file with a home-manager activation script that copies a real settings.json only if it does not already exist, preserving tool mutability. |
config/default.nix |
Adds the new cursor and gemini config modules to the common configuration imports. |
config/cursor/hooks.json |
Defines Cursor hooks to run git-ai checkpoint cursor after file edits and before prompt submission. |
config/cursor/default.nix |
Installs the Cursor .cursor/hooks.json file into the home directory, forcing overwrites. |
config/cliproxyapi/config.yaml |
Tunes routing strategy (fill-first), swaps the OpenRouter GLM mapping to an @preset/glm-4-7 alias, and simplifies Z-AI GLM configuration to just glm-4.7. |
config/clawdbot/hydrate.sh |
New gateway launcher that reads secrets from files or env, templates clawdbot.json from clawdbot.template.json, sets ANTHROPIC_API_KEY, and starts the Clawdbot gateway. |
config/clawdbot/clawdbot.template.json |
New template-based Clawdbot config defining browser, model providers via cliproxy, default agents, Telegram channels (including the restored group ID), gateway auth, and plugin paths. |
config/claude/settings.json |
Adds Pre/Post tool hooks for Write/Edit/MultiEdit operations to invoke git-ai checkpoints with or without hook-input content. |
config/ccs/config.template.yaml |
Introduces a quota_management section for CCS, describing hybrid/auto/manual modes and thresholds. |
Cargo.toml |
Adds a git dependency on git-ai so Rust tooling can drive checkpoints directly. |
Cargo.lock |
Regenerates the lockfile to include git-ai and its transitive dependencies. |
.github/workflows/upgrade.yml |
Enhances the scheduled overlay upgrade workflow to capture the PR number and enable auto-merge via gh pr merge when a PR is created. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Service = { | ||
| Type = "simple"; | ||
| ExecStart = "${pkgs.bash}/bin/bash ${hydrateScript}"; | ||
| Restart = "always"; | ||
| RestartSec = "5s"; | ||
| Environment = [ | ||
| "HOME=${homeDir}" | ||
| ]; | ||
| RunAtLoad = true; | ||
| KeepAlive = true; | ||
| StandardErrorPath = "/tmp/clawdbot-tunnel.err.log"; | ||
| WorkingDirectory = "${homeDir}/.clawdbot"; | ||
| StandardOutput = "append:/tmp/clawdbot/clawdbot-gateway.log"; | ||
| StandardError = "append:/tmp/clawdbot/clawdbot-gateway.log"; |
There was a problem hiding this comment.
The clawdbot-gateway unit sets WorkingDirectory = "${homeDir}/.clawdbot", but this directory is never created before the service starts; because systemd changes into the working directory before running ExecStart, the service will fail to start on a fresh install and hydrate.sh will never get a chance to create STATE_DIR. Consider either creating ${homeDir}/.clawdbot in a home-manager activation step (similar to clawdbotLogDir/clawdbotSecretsDir) or dropping WorkingDirectory if it is not strictly required.
| # Read secret from file, stripping whitespace | ||
| read_secret() { | ||
| local file="$1" | ||
| if [ -f "$file" ]; then | ||
| tr -d '\n\r' <"$file" | ||
| else | ||
| echo "" | ||
| fi | ||
| } | ||
|
|
||
| # Load secrets from files or environment | ||
| CLIPROXY_API_KEY="${CLIPROXY_API_KEY:-$(read_secret "${SECRETS_DIR}/cliproxy-key")}" | ||
| TELEGRAM_TOKEN="${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}" | ||
| GATEWAY_TOKEN="${GATEWAY_TOKEN:-$(read_secret "${SECRETS_DIR}/gateway-token")}" | ||
| ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-$(read_secret "${SECRETS_DIR}/anthropic-key")}" | ||
|
|
||
| # Chromium path (injected by nix) | ||
| CHROMIUM_PATH="@chromium@/bin/chromium" | ||
|
|
||
| # Create state directory if needed | ||
| mkdir -p "$STATE_DIR" | ||
|
|
||
| # Generate config from template with secret substitution | ||
| @sed@ \ | ||
| -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \ | ||
| -e "s|__TELEGRAM_TOKEN__|${TELEGRAM_TOKEN}|g" \ | ||
| -e "s|__GATEWAY_TOKEN__|${GATEWAY_TOKEN}|g" \ | ||
| -e "s|__CHROMIUM_PATH__|${CHROMIUM_PATH}|g" \ | ||
| -e "s|__HOME__|${HOME}|g" \ | ||
| "$TEMPLATE" >"$CONFIG" | ||
|
|
||
| echo "Generated clawdbot config at $CONFIG" >&2 | ||
|
|
||
| # Export Anthropic API key for clawdbot | ||
| if [ -n "$ANTHROPIC_API_KEY" ]; then | ||
| export ANTHROPIC_API_KEY | ||
| fi | ||
|
|
||
| # Start clawdbot gateway | ||
| exec @clawdbot@/bin/clawdbot gateway --port 18789 "$@" |
There was a problem hiding this comment.
This new config/clawdbot/hydrate.sh script is not yet covered by the shellspec harness: spec/coverage_spec.sh’s covered_scripts list does not include this path, and it still references the removed home-manager/modules/clawdbot/extract-secrets.sh. As a result, the "covers all non-spec shell scripts" test will start failing once this lands; please add a dedicated spec for config/clawdbot/hydrate.sh and update covered_scripts to drop the old script and include this one.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 34 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="Cargo.toml">
<violation number="1" location="Cargo.toml:10">
P2: Git dependency is pinned to the moving `main` branch without a lockfile, making builds non‑reproducible and susceptible to upstream changes.</violation>
</file>
<file name="config/clawdbot/hydrate.sh">
<violation number="1" location="config/clawdbot/hydrate.sh:43">
P2: Secrets are inserted into sed replacements without escaping, so tokens containing `&`, `|`, or JSON special characters can break sed or produce invalid JSON.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| path = "lib.rs" | ||
|
|
||
| [dependencies] | ||
| git-ai = { git = "https://github.com/git-ai-project/git-ai", branch = "main" } |
There was a problem hiding this comment.
P2: Git dependency is pinned to the moving main branch without a lockfile, making builds non‑reproducible and susceptible to upstream changes.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Cargo.toml, line 10:
<comment>Git dependency is pinned to the moving `main` branch without a lockfile, making builds non‑reproducible and susceptible to upstream changes.</comment>
<file context>
@@ -7,4 +7,5 @@ edition = "2021"
path = "lib.rs"
[dependencies]
+git-ai = { git = "https://github.com/git-ai-project/git-ai", branch = "main" }
worktrunk = "0.18.2"
</file context>
|
|
||
| # Generate config from template with secret substitution | ||
| @sed@ \ | ||
| -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \ |
There was a problem hiding this comment.
P2: Secrets are inserted into sed replacements without escaping, so tokens containing &, |, or JSON special characters can break sed or produce invalid JSON.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/clawdbot/hydrate.sh, line 43:
<comment>Secrets are inserted into sed replacements without escaping, so tokens containing `&`, `|`, or JSON special characters can break sed or produce invalid JSON.</comment>
<file context>
@@ -0,0 +1,58 @@
+
+# Generate config from template with secret substitution
+@sed@ \
+ -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \
+ -e "s|__TELEGRAM_TOKEN__|${TELEGRAM_TOKEN}|g" \
+ -e "s|__GATEWAY_TOKEN__|${GATEWAY_TOKEN}|g" \
</file context>
Summary
Test plan
make buildpassesmake switchapplies successfullymake synccompletes without permission errors🤖 Generated with Claude Code
Summary by cubic
Switch Gemini settings.json from a symlink to a real file via a Home Manager activation script so tools like ruler can write to it. Restores Telegram channel config in the Clawdbot template.
Bug Fixes
Migration
Written for commit 2f1f1a6. Summary will update on new commits.