codex's config.toml held nine live API keys inline under
[mcp_servers.*.env] -- deepseek, gemini, kimi, mimo, qwen, glm, cursor,
an OpenAI key and a Home Assistant token -- so it could not be tracked
as it stood. TOML env tables take literal values only, with no ${VAR}
indirection or env_file, so the keys cannot simply be named there.
Move them to ~/.codex/secrets.env (0600, ignored) and route the four
affected servers through mcp-with-secrets.sh, which sources that file
and execs the real command. Doing it in the wrapper rather than relying
on exported shell vars means it does not depend on how codex handles
environment inheritance, and works on ssh-only boxes with no keychain or
1Password agent, which is why this was preferred over a chezmoi
template.
Adds configs for claude, codex, pi, grok, kimi, kimi-code and reasonix,
and extends .chezmoiignore so credentials, session logs, local state and
.bak files stay out even if a directory is ever added whole.
Held back for still containing live keys: opencode.json (bailian), and
reasonix config.json and .env.
theme-mode is a per-machine preference, and the three *-theme.auto.conf
files are generated from it plus themes/, so tracking any of them made
every machine flag the others' choice. Drop all four from the source
state and ignore them.
That leaves a freshly applied machine with no theme files for kitty to
read, so add run_after_kitty-theme-mode.sh to regenerate them from the
canonical themes. It defaults to `auto`, so a new machine follows its OS
until told otherwise, and it exits quietly where this kitty config isn't
applied rather than failing the run.
Since that script now runs on every apply, including on Linux, make the
permission lookup in both shell scripts fall back from BSD `stat -f` to
GNU `stat -c` and then to 600.
