@eventmodelers/cli 1.0.136 → 1.0.137

package/cli.js

@@ -1952,7 +1952,7 @@ async function ensureGlobalKit(baseUrl) {
 // untargeted is handed straight back to the queue for another agent to take. It says
 // nothing about the standalone lane — a self-directed turn is nobody's task, so an
 // exclusive standalone agent still works the board on its own initiative.
-async function runModeling(kitDir, projectDir, { codeDir = null, verbose = false, standalone = false, exclusive = false, worker = false, overrides = null, maxAgents = DEFAULT_MAX_AGENTS, identity = {}, localAi = null, exec = null, model = null, skipPermissions = false } = {}) {
+async function runModeling(kitDir, projectDir, { codeDir = null, verbose = false, standalone = false, exclusive = false, worker = false, overrides = null, maxAgents = DEFAULT_MAX_AGENTS, identity = {}, localAi = null, exec = null, model = null, skipPermissions = false, browser = false } = {}) {
   // --worker: only prompts — no chat, and no board-change turns (it has nowhere to propose).
   const chat = !worker;
   const configLibPath = join(kitDir, 'lib', 'config.js');
@@ -2117,6 +2117,7 @@ async function runModeling(kitDir, projectDir, { codeDir = null, verbose = false
       codeDir,
       tmpDir: tmpdir(),
       hookCommand: `"${process.execPath}" "${fileURLToPath(new URL('./lib/bash-guard-hook.js', import.meta.url))}"`,
+      browser,
     });
   if (skipPermissions) {
     console.warn('⚠️  --dangerously-skip-permissions: every tool call this agent makes is approved — any shell command, curl to anywhere, any file you can read or write. Anyone who can chat with it on this board can make it do that.\n');
@@ -3681,6 +3682,7 @@ credentialFlags(program
   .option('--global', 'Run the modeling agent from the global install (~/.eventmodelers/kit), initializing it on first use, and ignore any kit in this directory. This is also what --modeling/--standalone fall back to on their own when nothing is installed here — pass it explicitly to prefer the global install over a local one. Credentials come from the flags below, EVENTMODELERS_* env vars, or ~/.eventmodelers/boards/<board>.json, so nothing is written into the current directory.')
   .option('--local', 'Skip platform config/credential lookup entirely and run the local-only loop (no board sync, no realtime agent) — even if .eventmodelers/config.json has credentials (build-kit stacks only)')
   .option('--dangerously-skip-permissions', 'Run the modeling agent\'s Claude process with --dangerously-skip-permissions, as before the lockdown: every tool call is approved — any shell command, curl to anywhere, any file the user can read or write, every MCP server the machine configures. Off by default because the agent takes chat messages and snippet clicks from any collaborator on the board; pass it only for a board whose collaborators you trust with your shell. Default Claude runner of --modeling/--standalone/--worker/--global only — not with --agent, --exec or --local-ai, which bring their own permission flags.')
+  .option('--browser', 'Give the locked-down modeling agent a browser: the Playwright MCP server (npx @playwright/mcp) next to the eventmodelers one, for discover-storyboard. Off by default because a browser can reach any site, which the lockdown otherwise rules out. Default Claude runner only; --dangerously-skip-permissions already loads every MCP server the machine configures.')
   .option('--verbose', 'Log every tool call\'s full input (commands, skill args, file paths) and assistant reasoning text. Default is condensed, high-level per-step logging only.')
   .option('--id <id>', 'Pin the agent id this run identifies itself with on the platform. A project install otherwise mints one id per project and reuses it on every restart; --global/--standalone mints a fresh one per run, since two ad-hoc agents for one board must not share a row (the heartbeat is keyed on token + agent_id + agent_type, so the second would replace the first). Pass this when an agent has to keep ONE identity across restarts — a supervisor that already knows the id, or a board where it is the starred "preferred agent". Per-run only: nothing is written to disk.')
   .option('--name <name>', 'A human-readable name for this agent, sent with every heartbeat so the board shows which agent is live rather than a bare uuid (e.g. "ci-builder", "martins-laptop"). Per-run only, like --id: the persistent name is `agentName` in config.json (set via `init --name` / `init-config --name`), and this overrides it for one run without writing anything.')
@@ -3793,6 +3795,10 @@ credentialFlags(program
         console.error(`❌ --force asks for credentials again, which --non-interactive/--print rule out — pick one.`);
         process.exit(1);
       }
+      if (opts.browser && (opts.exec || modelingLocalAi !== null || opts.dangerouslySkipPermissions)) {
+        console.error('❌ --browser only applies to the locked-down default Claude runner — --agent/--exec and --dangerously-skip-permissions use the MCP servers the machine configures, and --local-ai has no tools.');
+        process.exit(1);
+      }
       if (opts.dangerouslySkipPermissions && (opts.exec || modelingLocalAi !== null)) {
         console.error('❌ --dangerously-skip-permissions only applies to the default Claude runner — --agent/--exec bring their own permission flags (put them in the command), and --local-ai has no shell or file tools to approve.');
         process.exit(1);
@@ -3861,7 +3867,7 @@ credentialFlags(program
       const runnerLabel = modelingLocalAi ? 'local model' : opts.exec ? 'one agent process per turn' : 'warm Claude process';
       await new Promise((res) => process.stdout.write(`▶ Starting modeling loop (${runnerLabel}) for ${shown && !shown.startsWith('..') ? shown : kitDir}...\n\n`, res));
       try {
-        await runModeling(kitDir, projectDir, { codeDir, verbose: !!opts.verbose, standalone: !!opts.standalone, exclusive: !!opts.exclusive, worker: !!opts.worker, overrides, maxAgents, identity, localAi: modelingLocalAi, exec: opts.exec ?? null, model: !opts.exec && modelingLocalAi === null ? model : null, skipPermissions: !!opts.dangerouslySkipPermissions });
+        await runModeling(kitDir, projectDir, { codeDir, verbose: !!opts.verbose, standalone: !!opts.standalone, exclusive: !!opts.exclusive, worker: !!opts.worker, overrides, maxAgents, identity, localAi: modelingLocalAi, exec: opts.exec ?? null, model: !opts.exec && modelingLocalAi === null ? model : null, skipPermissions: !!opts.dangerouslySkipPermissions, browser: !!opts.browser });
       } catch (err) {
         console.error('[modeling] Fatal:', err);
         process.exit(1);

package/lib/agent-permissions.js

@@ -5,12 +5,14 @@
 // - --permission-mode dontAsk: a tool call that is not explicitly allowed is refused on the spot — nobody is asked
 //   (with stream-json a permission prompt would go to this CLI, which never answers, and the turn would hang).
 // - --strict-mcp-config + --mcp-config: the eventmodelers server is the only MCP server, whatever else the machine's
-//   user or project settings configure; mcp__eventmodelers allows all of its tools.
+//   user or project settings configure; mcp__eventmodelers allows all of its tools. With `browser`, the Playwright
+//   server (@playwright/mcp) joins it for discover-storyboard — opt-in, since a browser reaches any site.
 // - Bash goes through lib/bash-guard-hook.js (a PreToolUse hook): it allows only the commands on lib/bash-guard.js's
 //   list — curl only to the platform — and denies the rest. There is no Bash allow rule, so a command the hook does
 //   not explicitly allow is refused by dontAsk.
 // - Files: reading and editing in the kit directory (the working directory) and the temp directories; reading the
-//   code directory (--add-dir). Never the files holding the token, never .claude/ or .mcp.json (an agent rewriting
+//   code directory (--add-dir). Never the files holding the token (.eventmodelers/*.json — the rest of .eventmodelers/,
+//   e.g. the interview trail in .eventmodelers/interviews/, stays usable), never .claude/ or .mcp.json (an agent rewriting
 //   its own permissions or hooks would outlive the turn), never .env files. No WebFetch / WebSearch.
 
 import { realpathSync } from 'fs';
@@ -23,23 +25,24 @@ const abs = (path) => `/${path}`;
  * The claude arguments and environment for a locked-down modeling agent.
  * { baseUrl, projectDir, codeDir?, tmpDir, hookCommand } → { args: string[], env: Record<string, string> }
  */
-export function modelingPermissions({ baseUrl, projectDir, codeDir, tmpDir, hookCommand }) {
+export function modelingPermissions({ baseUrl, projectDir, codeDir, tmpDir, hookCommand, browser = false }) {
   const tempDirs = [...new Set(['/tmp', '/private/tmp', tmpDir, realOrSame(tmpDir)].filter(Boolean))];
   const roots = [...new Set([projectDir, realOrSame(projectDir), codeDir, codeDir && realOrSame(codeDir), ...tempDirs].filter(Boolean))];
 
   const allowed = [
     'mcp__eventmodelers',
+    ...(browser ? ['mcp__playwright'] : []),
     'Skill', 'Agent', 'Task', 'TodoWrite', 'ToolSearch',
     // Edit rules cover every file-editing tool (Write included) — Claude ignores Write(path) rules.
     'Edit(./**)',
     ...tempDirs.flatMap((dir) => [`Read(${abs(dir)}/**)`, `Edit(${abs(dir)}/**)`]),
   ];
-  const secretReads = ['./.claude/settings.local.json', './.claude/settings.json', './.eventmodelers/**', './**/.eventmodelers/**', './**/.env', './**/.env.*'];
+  const secretReads = ['./.claude/settings.local.json', './.claude/settings.json', './.eventmodelers/*.json', './**/.eventmodelers/*.json', './**/.env', './**/.env.*'];
   const disallowed = [
     'WebFetch', 'WebSearch',
     ...secretReads.map((p) => `Read(${p})`),
     ...(codeDir ? [`Read(${abs(codeDir)}/**/.env)`, `Read(${abs(codeDir)}/**/.env.*)`] : []),
-    'Edit(./.claude/**)', 'Edit(./.mcp.json)', 'Edit(./.eventmodelers/**)', 'Edit(./**/.eventmodelers/**)',
+    'Edit(./.claude/**)', 'Edit(./.mcp.json)', 'Edit(./.eventmodelers/*.json)', 'Edit(./**/.eventmodelers/*.json)',
   ];
 
   const mcpConfig = {
@@ -50,6 +53,7 @@ export function modelingPermissions({ baseUrl, projectDir, codeDir, tmpDir, hook
         // Resolved by claude from its own environment — the token never sits in an argument.
         headers: { 'x-token': '${EVENTMODELERS_TOKEN}', 'x-agent-id': '${EVENTMODELERS_AGENT_ID}' },
       },
+      ...(browser ? { playwright: { type: 'stdio', command: 'npx', args: ['-y', '@playwright/mcp@latest'] } } : {}),
     },
   };
   const settings = {

package/lib/bash-guard.js

@@ -9,8 +9,9 @@
 // - Programs: curl (only to the platform's baseUrl), python3 (two exact forms), uuidgen, jq, git (read-only
 //   subcommands), and read-only text tools (cat, head, tail, wc, sort, uniq, grep, cut, tr, ls), echo, printf,
 //   mkdir, sleep, date, true. Nothing else — no sh/bash/eval/env/xargs/find/sed/awk/node/npm/rm/mv/cp.
-// - No command substitution ($(…), `…`, $((…)), <(…)), subshells, brace groups, brace expansion, background jobs,
-//   control flow, or ~ paths.
+// - No command substitution ($(…), `…`, $((…)), <(…)) except exactly $(uuidgen) and $(seq N) / $(seq A B) — they mint
+//   ids and run nothing else. No subshells, brace groups, brace expansion, background jobs or ~ paths. The only control
+//   flow is `for NAME in …; do …; done` (its body checked like any other command; NAME counts as set).
 // - Variables: only BASE_URL, ORG_ID, BOARD_ID, AGENT_ID, CHAT_SESSION_ID, EVENTMODELERS_AGENT_ID, CLAUDE_CODE_SESSION_ID and names assigned in
 //   the same command. The token ($EVENTMODELERS_TOKEN / $TOKEN) only inside a curl -H value — never echoed, written or
 //   passed elsewhere. Assigning BASE_URL is fine only to the real baseUrl; PATH, proxies, LD_*/DYLD_*/GIT_* … never.
@@ -21,7 +22,7 @@ import { isAbsolute, resolve, sep } from 'path';
 
 const SAFE_VARS = new Set(['BASE_URL', 'ORG_ID', 'BOARD_ID', 'AGENT_ID', 'CHAT_SESSION_ID', 'EVENTMODELERS_AGENT_ID', 'CLAUDE_CODE_SESSION_ID']);
 const TOKEN_VARS = new Set(['TOKEN', 'EVENTMODELERS_TOKEN']);
-const PROTECTED_VAR = /^(PATH|HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|CDPATH|GLOBIGNORE|TMPDIR|SHELL|USER|LD_.*|DYLD_.*|GIT_.*|CURL.*|SSL_.*|NODE_.*|PYTHON.*|.*PROXY.*|EVENTMODELERS_.*|ANTHROPIC_.*|CLAUDE.*)$/i;
+const PROTECTED_VAR = /^(PATH|HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|CDPATH|GLOBIGNORE|TMPDIR|SHELL|USER|LD_.*|DYLD_.*|GIT_.*|CURL.*|SSL_.*|NODE_OPTIONS|NODE_PATH|NODE_TLS_.*|NODE_EXTRA_.*|PYTHON.*|.*PROXY.*|EVENTMODELERS_.*|ANTHROPIC_.*|CLAUDE.*)$/i;
 
 class Refused extends Error {}
 const refuse = (reason) => { throw new Refused(reason); };
@@ -39,7 +40,11 @@ function lex(command) {
   const readVar = (word) => {
     // at command[i] === '$'
     const next = command[i + 1];
-    if (next === '(') refuse('command substitution $(…) is not allowed');
+    if (next === '(') {
+      const sub = /^\$\((?:uuidgen|seq \d{1,4}(?: \d{1,4})?)\)/.exec(command.slice(i));
+      if (!sub) refuse('command substitution $(…) is not allowed — only $(uuidgen) and $(seq N)');
+      word.text += sub[0]; i += sub[0].length; return;
+    }
     if (next === '{') {
       const end = command.indexOf('}', i + 2);
       const name = end < 0 ? '' : command.slice(i + 2, end);
@@ -155,6 +160,8 @@ function lex(command) {
 
 // ─── Commands ───────────────────────────────────────────────────────────────────────────────────
 
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+
 /** Splits the tokens into simple commands: leading assignments, words, redirections, heredocs. */
 function simpleCommands(tokens) {
   const commands = [];
@@ -164,7 +171,7 @@ function simpleCommands(tokens) {
     if (!current) { current = { assignments: [], words: [], redirects: [], heredocs: [] }; commands.push(current); }
     if (t.type === 'redirect') current.redirects.push(t);
     else if (t.type === 'heredoc') current.heredocs.push(t);
-    else if (!current.words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(t.text) && !t.text.startsWith('=')) {
+    else if (!current.words.length && ASSIGNMENT.test(t.text)) {
       const eq = t.text.indexOf('=');
       current.assignments.push({ name: t.text.slice(0, eq), value: t.text.slice(eq + 1), word: t });
     } else current.words.push(t);
@@ -172,6 +179,46 @@ function simpleCommands(tokens) {
   return commands;
 }
 
+/**
+ * Takes the `for NAME in …; do …; done` keywords out of the simple commands, leaving the loop items on the `for`
+ * command (as `loopItems`, checked like words) and each body command as a plain command. Returns the loop variables.
+ */
+function unwrapLoops(commands) {
+  const loopVars = [];
+  let open = 0;
+  let expectDo = false;
+  for (const cmd of commands) {
+    const first = cmd.words[0];
+    const keyword = first && !first.quoted && !first.refs.length ? first.text : null;
+    if (expectDo && keyword !== 'do') refuse('a for loop needs "do" after its list');
+    if (keyword === 'for') {
+      const [, name, inWord, ...items] = cmd.words;
+      if (cmd.assignments.length || cmd.redirects.length || cmd.heredocs.length || !name || name.quoted
+        || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name.text) || inWord?.text !== 'in' || inWord.quoted) {
+        refuse('only "for NAME in …; do …; done" loops are allowed');
+      }
+      if (PROTECTED_VAR.test(name.text) || TOKEN_VARS.has(name.text)) refuse(`setting ${name.text} is not allowed`);
+      loopVars.push(name.text);
+      cmd.loopItems = items; cmd.words = [];
+      open += 1; expectDo = true;
+    } else if (keyword === 'do') {
+      if (!expectDo) refuse('"do" outside a for loop');
+      expectDo = false;
+      cmd.words.shift();
+      while (cmd.words.length && ASSIGNMENT.test(cmd.words[0].text)) {
+        const w = cmd.words.shift();
+        const eq = w.text.indexOf('=');
+        cmd.assignments.push({ name: w.text.slice(0, eq), value: w.text.slice(eq + 1), word: w });
+      }
+    } else if (keyword === 'done') {
+      if (!open || cmd.words.length > 1 || cmd.assignments.length) refuse('"done" outside a for loop');
+      open -= 1; cmd.words = [];
+    }
+  }
+  if (open || expectDo) refuse('a for loop is never closed with "done"');
+  return loopVars;
+}
+
 function withinRoots(path, policy) {
   if (path === '/dev/null' || path === '-') return true;
   if (path.includes('$')) refuse(`path "${path}" may not contain a variable`);
@@ -373,7 +420,7 @@ export function checkBashCommand(command, policy) {
   try {
     if (typeof command !== 'string' || !command.trim()) refuse('empty command');
     const commands = simpleCommands(lex(command));
-    const assigned = new Set();
+    const assigned = new Set(unwrapLoops(commands));
     for (const cmd of commands) {
       for (const a of cmd.assignments) {
         if (PROTECTED_VAR.test(a.name) || TOKEN_VARS.has(a.name)) refuse(`setting ${a.name} is not allowed`);
@@ -386,7 +433,7 @@ export function checkBashCommand(command, policy) {
       for (const r of cmd.redirects) {
         if (r.op !== '<<<') checkPath(r.target.text, r.op === '<' ? 'input file' : 'output file', policy);
       }
-      const parts = [...cmd.words, ...cmd.assignments.map((a) => a.word), ...cmd.redirects.map((r) => r.target), ...cmd.heredocs];
+      const parts = [...cmd.words, ...(cmd.loopItems ?? []), ...cmd.assignments.map((a) => a.word), ...cmd.redirects.map((r) => r.target), ...cmd.heredocs];
       for (const w of parts) {
         if (w.braceOrTilde && w.type === 'word') refuse(`"${w.text}": brace expansion and ~ are not allowed — quote it or spell the path out`);
         for (const name of w.refs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventmodelers/cli",
-  "version": "1.0.136",
+  "version": "1.0.137",
   "description": "Eventmodelers CLI — real-time Claude agent + skills for Claude Code, for any stack (Node, Supabase, Axon, OpenCQRS, UmaDB, Kurrent, or modeling-only)",
   "type": "module",
   "bin": {

package/stacks/modeling-kit/templates/.claude/skills/discover-storyboard/SKILL.md

@@ -43,6 +43,7 @@ Install a browser automation MCP and restart Claude Code. Options:
   • Playwright MCP: @playwright/mcp
 
 Once installed, run /discover-storyboard again.
+A board modeling agent (`run --modeling`) only gets one when started with --browser.
 ```
 
 Do NOT invoke `connect`. Do NOT proceed to Step 1.

package/stacks/modeling-kit/templates/.claude/skills/place-element/references/api-fallback.md

@@ -172,17 +172,17 @@ Placing an EVENT called "Order Placed" at the end of a timeline, over curl:
 
 ```bash
 # 1. Add a column (append at end)
-curl -s -X POST "http://localhost:3000/api/org/<ORG_ID>/boards/<BOARD_ID>/timelines/<TIMELINE_ID>/columns" \
-  -H "Content-Type: application/json" \
+curl -s -X POST "$BASE_URL/api/org/$ORG_ID/boards/$BOARD_ID/timelines/<TIMELINE_ID>/columns" \
+  -H "x-token: $TOKEN" -H "Content-Type: application/json" \
   -d '{}'
 
 # 2. Fetch chapter to find the target lane cell for the new column
-curl -s -H "x-user-id: place-element-skill" \
-  "http://localhost:3000/api/org/<ORG_ID>/boards/<BOARD_ID>/nodes/<TIMELINE_ID>?projection=cells"
+curl -s -H "x-token: $TOKEN" -H "x-user-id: place-element-skill" \
+  "$BASE_URL/api/org/$ORG_ID/boards/$BOARD_ID/nodes/<TIMELINE_ID>?projection=cells"
 
 # 3. Create the EVENT node — do not skip the x-user-id header
-curl -s -X POST "http://localhost:3000/api/org/<ORG_ID>/boards/<BOARD_ID>/nodes/events" \
-  -H "Content-Type: application/json" \
+curl -s -X POST "$BASE_URL/api/org/$ORG_ID/boards/$BOARD_ID/nodes/events" \
+  -H "x-token: $TOKEN" -H "Content-Type: application/json" \
   -H "x-user-id: place-element-skill" \
   -d '[{
     "id": "<event-uuid>",

package/stacks/modeling-kit/templates/kit/CLAUDE.md

@@ -144,7 +144,7 @@ mention it in the `DONE` comment, and leave it for a self-directed turn (or for
    And it applies **downwards**, to any subagent you dispatch. A subagent is a fresh session that inherits none of this one's state, so hand it `token=`, `org=`, `baseUrl=` and `board=` inline as already-resolved values (the token exactly as the header gave it, `token=$EVENTMODELERS_TOKEN` — the reference, never its value; the subagent inherits the same environment) and tell it explicitly not to invoke `/connect`: all four inline satisfy that skill outright at its Step 0. When this turn has a `CHAT_SESSION_ID` (step 3), hand that down too, as `session=` — the subagent's writes are part of the same chat's work. Three agents that each resolve and verify the same credentials pay for the connect you already did, three more times over.
 
    The same "don't reload what's already loaded" logic applies to `/learn-eventmodelers-api`: it's a lookup reference, not a mandatory preamble. Every skill already documents the exact API calls it needs inline — only invoke `/learn-eventmodelers-api` on demand, for a specific endpoint/field/type a skill's own instructions don't cover, and only once per session even then.
-3. **Resolve `BOARD_ID`** from this turn's `board_id` field; if absent, fall back to `boardId` in `.eventmodelers/config.json`.
+3. **Resolve `BOARD_ID`** from this turn's `board_id` field; if absent, fall back to `$BOARD_ID` (set in your environment from the connected board's config).
    **Resolve `TIMELINE_ID`** from this turn's `context.timelineId`, if present and non-null; otherwise use this turn's `timeline_id` field. `context.timelineId` reflects the chapter the user was actually pointing at on the canvas (a selected cell or node) when they issued the prompt, which can differ from `timeline_id` — the chapter the voice/prompt session happened to be scoped to — so it wins whenever both are present.
    **Resolve `NODE_ID`** from the first entry of this turn's `context.selectedNodes`, if that array is present and non-empty; otherwise use this turn's `node_id` field. `context.selectedNodes` reflects what was actually selected on the canvas when the prompt was issued, which can differ from `node_id` — set only when the prompt originated from a specific node/comment — so it wins whenever both are present.
    **Resolve `CELL_ID`** from this turn's `context.selectedCell.id`, if present and non-null. When present, it overrules any cell reference (e.g. `"A2"`) parsed from the prompt text itself — it reflects the actual cell the user had selected on the canvas when they issued the prompt, and is more reliable than free-text parsing.
@@ -173,15 +173,17 @@ mention it in the `DONE` comment, and leave it for a self-directed turn (or for
 You run locked down, because chat messages and snippet clicks reach you from any collaborator on the board. A tool
 call that isn't allowed is refused at once — nobody is asked — and the refusal says why; don't retry it in another
 form, do the work another way or tell the person what you can't do.
-- **MCP:** only the eventmodelers server (`mcp__eventmodelers__*`) — prefer it for every board read and write.
+- **MCP:** only the eventmodelers server (`mcp__eventmodelers__*`) — prefer it for every board read and write — plus
+  a Playwright browser (`mcp__playwright__*`) when the agent was started with `--browser`.
 - **Bash:** only `curl` to the platform (`$BASE_URL` — set for you, like `$ORG_ID`, `$BOARD_ID` and `$TOKEN`), with
-  `$TOKEN` / `$EVENTMODELERS_TOKEN` only in a `-H` header; uuids with `uuidgen` or `python3 -c` using only
-  `uuid.uuid4()` (one, a loop, a joined list); `jq`; `python3 -m json.tool`; read-only `git` (`git -C <code dir> …`);
-  `cat`/`head`/`tail`/`wc`/`sort`/`uniq`/`grep`/`cut`/`tr`/`ls`, `echo`, `printf`, `mkdir`. No `$(…)`, shell loops,
-  other `python3` scripts, `node`, `rm`, `cd`. Build a JSON payload with the Write tool in `/tmp`, then
+  `$TOKEN` / `$EVENTMODELERS_TOKEN` only in a `-H` header; uuids with `uuidgen`, `$(uuidgen)`,
+  `for i in $(seq <n>); do uuidgen; done` or `python3 -c` using only `uuid.uuid4()`; `jq`; `python3 -m json.tool`;
+  read-only `git` (`git -C <code dir> …`); `cat`/`head`/`tail`/`wc`/`sort`/`uniq`/`grep`/`cut`/`tr`/`ls`, `echo`,
+  `printf`, `mkdir`; `for NAME in …; do …; done` loops over these. No other `$(…)`, no `while`/`if`, other `python3`
+  scripts, `node`, `rm`, `cd`. Build a JSON payload with the Write tool in `/tmp`, then
   `curl … --data-binary @/tmp/<file>.json`.
 - **Files:** read and write in this directory and `/tmp`, read the code directory. Never `.claude/`, `.mcp.json`,
-  `.eventmodelers/` or `.env` files. No web access.
+  `.eventmodelers/*.json` or `.env` files (`.eventmodelers/interviews/` is fine). No web access.
 
 ## Chat turns — `CHAT`