Prefer env vars over secret store for API credentials

All scripts now check GLM_API_KEY / TK_AI_API_TOKEN environment
variables first, falling back to Keychain/libsecret only when unset.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -0,0 +1,41 @@
+# ~/bin — Custom CLI Utilities
+
+## Environment Variables
+
+All scripts accept environment variables as the primary credential source. If set, the secret store (macOS Keychain / Linux libsecret) is skipped.
+
+| Variable | Used by | Description |
+|---|---|---|
+| `GLM_API_KEY` | `claude-glm`, `glm-quota` | Zhipu AI (GLM) API key |
+| `TK_AI_API_TOKEN` | `claude-tk`, `ask` | TK AI API token |
+
+### Precedence
+
+1. **Environment variable** (if set, used directly)
+2. **Secret store** (macOS Keychain via `security`, or Linux `secret-tool`)
+3. **Error** if neither source provides a value
+
+### Usage Examples
+
+```sh
+# Override for a single invocation
+GLM_API_KEY=xxx claude-glm
+
+# Export for the session
+export TK_AI_API_TOKEN=xxx
+ask "how to find large files"
+```
+
+### Secret Store Setup
+
+**macOS (Keychain):**
+```sh
+security add-generic-password -a "$USER" -s GLM_API_KEY -w "YOUR_KEY"
+security add-generic-password -a "$USER" -s TK_AI_API_TOKEN -w "YOUR_KEY"
+```
+
+**Linux / Arch (libsecret):**
+```sh
+echo "YOUR_KEY" | secret-tool store --label "GLM API Key" service GLM_API_KEY
+echo "YOUR_KEY" | secret-tool store --label "AI API Token" service TK_AI_API_TOKEN
+```