From 94c71a016f32c1a7156498b1a70878c46faf19cf Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Fri, 9 Oct 2026 13:17:45 -0700
Subject: [PATCH] fix(zsh): source KAGI_API_KEY and HF_TOKEN from 600-perm
 secret files

Keys live in ~/.config/secrets/{kagi_api_key,hf_token}; .zshrc only reads
them, so the literals leave the shell rc that this repo publishes to Gitea.
---
 dotfiles/zz-blankpad/zsh/.zshrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dotfiles/zz-blankpad/zsh/.zshrc b/dotfiles/zz-blankpad/zsh/.zshrc
index 9c76c3d..f5fded4 100644
--- a/dotfiles/zz-blankpad/zsh/.zshrc
+++ b/dotfiles/zz-blankpad/zsh/.zshrc
@@ -1,3 +1,6 @@
 source /usr/share/cachyos-zsh-config/cachyos-config.zsh
 
+[ -f ~/.config/secrets/kagi_api_key ] && export KAGI_API_KEY="$(cat ~/.config/secrets/kagi_api_key)"
+[ -f ~/.config/secrets/hf_token ] && export HF_TOKEN="$(cat ~/.config/secrets/hf_token)"
+
 [ -d "$HOME/.bun/bin" ] && export PATH="$HOME/.bun/bin:$PATH"