CRITICAL: api_key 'ClauderAPI2' was committed to PUBLIC unlimitedcoding
repo (private:False on gitea) in 4 *_config.json + 8 ps1 scripts. Anyone
on the internet could read it via curl with no auth (HTTP 200 raw access).
This commit:
1. Sanitizes 4 *_config.json: api_key → "YOUR_API_KEY" + _note pointing
users to private config repo for production credentials.
2. Removes 'ClauderAPI2' literal from 8 ps1 installer/updater scripts
(claude/codex/gemini/qwen × install/update). Each script now has a
sanitized block at top that fetches api_key from private
unlimitedcoding-config repo at runtime via Authorization token.
3. Switches 6 sh installer scripts from public REPO_RAW to PRIVATE
unlimitedcoding-config base URL for *_config.json downloads.
4. Removes stale .patcher.config.cache.json (will regen on next install).
Production configs MOVED to private repo (separate commit e839102 on
unlimitedcoding-config/main).
KNOWN UNCHANGED:
- releases/v2.1.119/sea/cli-wrapper.cjs still has api_key (part of npm
package distribution; clients need it locally; sensey serves same).
- Read-only gitea token (cadffcb0...) remains in installers — needed
for token-auth fetch from private repo. Scoped read-only.
RECOMMEND: api_key rotation in proxy auth list because ClauderAPI2 was
publicly exposed for an unknown period. Existing client installs would
need re-install or env override.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
gemini -p / qwen -p crashes with "setRawMode EIO" when stdin is not
a TTY (running from sudo bash script.sh). Verification now uses
--version instead — fast, reliable, no TTY needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Problem: `sudo bash install.sh` runs in child process, `export` inside it
never reaches the user's current shell. /etc/environment and /etc/profile.d/
only work for NEW sessions. So `codex`/`gemini`/`qwen` fail with
"Missing environment variable" right after install.
Solution: wrapper scripts that auto-source env file before exec'ing binary.
- codex: /usr/local/bin/codex (wrapper) -> /usr/local/bin/.codex-bin (real)
- gemini: /usr/local/bin/gemini (wrapper) -> node .../dist/index.js
- qwen: /usr/local/bin/qwen (wrapper) -> node .../dist/index.js
Works immediately in ANY shell, no manual `source` needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install and update scripts now:
- Write GEMINI_API_KEY + GOOGLE_GEMINI_BASE_URL to /etc/environment (all users)
- Create /etc/profile.d/gemini-cli.sh for login shell export (all users)
- Export for current session
- Update script now also sets env vars (was missing entirely)
- Removed per-user ~/.bashrc approach — system-wide is more reliable
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- gemini/ugemini_install.sh: CURL_AUTH was defined but never used, fixed
- gemini/ugemini_update.sh: added GITEA_TOKEN + auth header
- qwen/uqwen_install.sh: use GITEA_TOKEN (was already defined but unused)
- qwen/uqwen_update.sh: added GITEA_TOKEN + auth header
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
yolo mode requires patching settingsSchema.js (Target 9a2) which is
not included in the npm package. auto_edit is the most permissive
built-in mode that works without JS patching.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- settings.json now includes security.folderTrust.enabled=false and
general.defaultApprovalMode=yolo to suppress trust/permission prompts
- Linux installer creates trustedFolders.json with common paths
- Windows PS1 installer creates trustedFolders.json for C:\ paths
- README Windows section adds $env: vars for current session
- Fixed BOM issue: all PS1 use WriteAllText instead of Set-Content
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ugemini_install.sh: npm registry setup, Node.js auto-install, retry logic, env vars for all users
- uqwen_install.sh: new installer — npm registry, patches, settings, env vars
- README.md: add one-line installer commands for Gemini and Qwen
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
