ZSH: Add zsh-ai-cmd plugin with macOS Keychain API key management

Add zsh-ai-cmd plugin for AI shell suggestions (Ctrl+Z for ghost text).
Uses Anthropic provider with claude-haiku-4-5-20251001.

API key is stored in macOS Keychain via a run_onchange_after script that
reads from 1Password and writes to Keychain as 'zsh-ai-cmd-anthropic'.
The script re-runs when the 1Password item's modification time changes.
The plugin's ZSH_AI_CMD_KEYCHAIN_NAME uses ${provider} interpolation so
switching providers only requires changing ZSH_AI_CMD_PROVIDER.

macOS only — the keychain script skips on Linux.

Author: jdevera

home/.chezmoidata/zsh_plugins.yaml

@@ -16,6 +16,8 @@
 zsh_plugins:
   - repo: zsh-users/zsh-autosuggestions
     description: "Fish-like autosuggestions for zsh"
+  - repo: kylesnowschwartz/zsh-ai-cmd
+    description: "AI shell suggestions with ghost text via Ctrl+Z"
   - repo: ohmyzsh/ohmyzsh
     description: "Community-driven zsh framework, used as a plugin source"
     plugins:

home/.chezmoiscripts/run_onchange_after_keychain-anthropic.sh.tmpl

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# trigger: {{ (onepassword "Anthropic API" "dotfiles").updated_at }}
+
+# {{ template "dotfiles_bashlib.sh" . }}
+
+# Help shellcheck identify the above include
+true || source ../.chezmoitemplates/dotfiles_bashlib.sh
+
+{{ if ne .chezmoi.os "darwin" -}}
+dot::chezmoi_script_skipped "macOS only"
+{{ else -}}
+
+dot::chezmoi_script_start "store Anthropic API key in macOS Keychain"
+
+KEYCHAIN_SERVICE="zsh-ai-cmd-anthropic"
+
+dot::step::start "read key from 1Password"
+key=$(op read "op://dotfiles/Anthropic API/credential") || dot::step::fatal
+dot::step::done
+
+dot::step::start "store in macOS Keychain"
+# Delete existing entry if present (security add fails on duplicates)
+security delete-generic-password -s "$KEYCHAIN_SERVICE" -a "$USER" 2>/dev/null
+security add-generic-password -s "$KEYCHAIN_SERVICE" -a "$USER" -w "$key" || dot::step::fatal
+dot::step::done
+
+dot::success "Anthropic API key stored in Keychain as '$KEYCHAIN_SERVICE'"
+
+{{ end -}}

home/dot_config/zsh/exact_private_zsh.d/private_007_plugin_config.zsh

@@ -4,3 +4,9 @@
 if plug::is_loaded zsh-autosuggestions; then
     ZSH_AUTOSUGGEST_STRATEGY=(history completion)
 fi
+
+if plug::is_loaded zsh-ai-cmd; then
+    ZSH_AI_CMD_PROVIDER=anthropic
+    ZSH_AI_CMD_ANTHROPIC_MODEL=claude-haiku-4-5-20251001
+    ZSH_AI_CMD_KEYCHAIN_NAME='zsh-ai-cmd-${provider}'
+fi