fix: add search config fallbacks

[Daltonganger]

Summary

• allow opencode.json search config parsing even when it contains // or /* */ comments
• add fallback sources for Brave and Tavily search keys via search-keys.json and direct BRAVE_API_KEY / TAVILY_API_KEY environment variables
• show the actual credential source in the Brave and Tavily providers, and keep the helper scripts aligned with the app lookup behavior

[kilo-code-bot]

Code Review Roast 🔥

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything.

Technical Analysis

This PR adds graceful fallback support for Brave Search and Tavily API keys through multiple sources:

1. search-keys.json - New config file for search API keys
2. Direct environment variables - BRAVE_API_KEY and TAVILY_API_KEY
3. JSON comment stripping - Handles // and /* */ comments in configs

Code Quality Highlights

• TokenManager.swift: The stripJSONComments() function correctly handles escape sequences inside strings (line 780-814), avoiding the classic bug of stripping comments that appear inside string literals. Thread safety is maintained via queue.sync wrapper.

• Fallback chain is sensible: opencode.json → search-keys.json → environment variables gives users flexibility without breaking existing setups.

• Shell scripts match Swift: The bash implementations in query-brave-search.sh and query-tavily-search.sh correctly mirror the Swift logic, including the same XDG path priority order.

• Proper error handling: Uses isReadableFile(atPath:) check before reading (line 711) - a nice touch that prevents crashes on permission-denied scenarios.

• Credential source tracking: The UI now shows exactly where the API key came from (opencode.json, search-keys.json, or Environment variable XXX) - much better for debugging auth issues than the previous hardcoded fallback.

• Minor style fix: AntigravityProvider removes unnecessary parentheses in condition (line 466) - not a bug, just cleaner.

Incremental Changes (since last review)

• Shell script temp file cleanup fix: Variables now initialized before trap registration, consolidated cleanup function prevents orphaned temp files
• SearchAPIKeyLookupSource refactoring: Clean struct-based pattern for unified key lookup across config sources
• Operator precedence verified: Swift's & has higher precedence than ==, so byte & 0x80 == 0 is semantically identical to (byte & 0x80) == 0

📊 Overall: Like finding a unicorn in production — I didn't think clean PRs existed anymore, but here we are.

Files Reviewed (6 files)

• CopilotMonitor/CopilotMonitor/Services/TokenManager.swift - Core implementation
• CopilotMonitor/CopilotMonitor/Providers/BraveSearchProvider.swift - Provider integration
• CopilotMonitor/CopilotMonitor/Providers/TavilySearchProvider.swift - Provider integration
• CopilotMonitor/CopilotMonitor/Providers/AntigravityProvider.swift - Style fix
• scripts/query-brave-search.sh - CLI alignment
• scripts/query-tavily-search.sh - CLI alignment