All scripts now check GLM_API_KEY / TK_AI_API_TOKEN environment variables first, falling back to Keychain/libsecret only when unset. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>