bootstrap_shell_secrets

#!/usr/bin/env bash

set -euo pipefail

secrets_dir="${XDG_CONFIG_HOME:-$HOME/.config}/secrets"
secrets_file="$secrets_dir/shell.env"
timestamp="$(date +"%Y%m%d%H%M%S")"

mkdir -p "$secrets_dir"

if [[ -f "$secrets_file" ]]; then
  cp "$secrets_file" "$secrets_file.$timestamp.bak"
  echo "📦 Backed up existing file to $secrets_file.$timestamp.bak"
fi

read_secret() {
  local var_name="$1"
  local prompt="$2"
  local value=""

  read -r -s -p "$prompt (leave blank to skip): " value
  echo

  if [[ -n "$value" ]]; then
    printf 'export %s="%s"\n' "$var_name" "$value" >>"$secrets_file"
    echo "✅ Added $var_name"
  else
    echo "⏭️  Skipped $var_name"
  fi
}

cat >"$secrets_file" <<'EOF'
# Shell secrets loaded by ~/.zshrc
# File permissions should remain restricted (chmod 600)
EOF

echo "🔐 Bootstrapping shell secrets at $secrets_file"
read_secret "OPENAI_API_KEY" "OpenAI API key"
read_secret "SUPERMEMORY_API_KEY" "Supermemory API key"
read_secret "ANTHROPIC_API_KEY" "Anthropic API key"

chmod 600 "$secrets_file"
echo "✅ Done. Saved secrets file with 600 permissions."