5b58460618
codex's config.toml held nine live API keys inline under
[mcp_servers.*.env] -- deepseek, gemini, kimi, mimo, qwen, glm, cursor,
an OpenAI key and a Home Assistant token -- so it could not be tracked
as it stood. TOML env tables take literal values only, with no ${VAR}
indirection or env_file, so the keys cannot simply be named there.
Move them to ~/.codex/secrets.env (0600, ignored) and route the four
affected servers through mcp-with-secrets.sh, which sources that file
and execs the real command. Doing it in the wrapper rather than relying
on exported shell vars means it does not depend on how codex handles
environment inheritance, and works on ssh-only boxes with no keychain or
1Password agent, which is why this was preferred over a chezmoi
template.
Adds configs for claude, codex, pi, grok, kimi, kimi-code and reasonix,
and extends .chezmoiignore so credentials, session logs, local state and
.bak files stay out even if a directory is ever added whole.
Held back for still containing live keys: opencode.json (bailian), and
reasonix config.json and .env.
22 lines
694 B
Bash
22 lines
694 B
Bash
# Populate GitHub MCP auth for Codex from a GitHub personal access token.
|
|
# The token value is exported into the process environment but is not stored here.
|
|
case "${CODEX_GITHUB_PERSONAL_ACCESS_TOKEN:-}" in
|
|
github_pat_*|ghp_*) ;;
|
|
*)
|
|
unset CODEX_GITHUB_PERSONAL_ACCESS_TOKEN
|
|
if command -v security >/dev/null 2>&1; then
|
|
_codex_github_token="$(security find-generic-password -a "$USER" -s codex-github-mcp-pat -w 2>/dev/null || true)"
|
|
else
|
|
_codex_github_token=""
|
|
fi
|
|
|
|
case "$_codex_github_token" in
|
|
github_pat_*|ghp_*)
|
|
export CODEX_GITHUB_PERSONAL_ACCESS_TOKEN="$_codex_github_token"
|
|
;;
|
|
esac
|
|
|
|
unset _codex_github_token
|
|
;;
|
|
esac
|