@tomato414941/foundation 0.12.0 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Foundation CLI: make a key, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {
@@ -11,7 +11,6 @@
   },
   "files": [
     "runtime.mjs",
-    "guide.mjs",
     "env-name.mjs"
   ],
   "repository": {

package/runtime.mjs

@@ -8,7 +8,6 @@ import { homedir, hostname, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
 import { validEnvName } from './env-name.mjs';
-import { guide } from './guide.mjs';
 
 // This program does only what the agent running it cannot do for itself.
 //
@@ -96,8 +95,7 @@ async function outputBytes(path) {
   } finally { await handle?.close(); }
 }
 
-// --help is the usual thing: the commands and their options. The guide (what Foundation is and how to ask it
-// for things) is its own command, since it is the server's document, not this program's.
+// --help describes the CLI. The server publishes its API contract at /openapi.json.
 const HELP = `Usage: foundation <command> [options]
 
 Commands:
@@ -109,9 +107,11 @@ Commands:
                                        Run a command with saved values in its environment.
   exec --inputs '<json>' -- <command>  The same, with files, structured inputs, or a credential for a service by id.
   exec --output '<json>' -- <command>  Also save a file the command writes.
-  guide                                Read the server's API guide (bundled reference when offline).
   version                              Print the version.
 
+API specification:
+  foundation api GET /openapi.json      Read the server's OpenAPI specification; no key required.
+
 Environment:
   FOUNDATION_URL               The server for this run (otherwise the one saved by connect).
   FOUNDATION_AGENT             Your name, such as claude or codex; gives each agent its own key file.
@@ -125,21 +125,6 @@ async function main() {
   if (action === '--version' || action === '-v' || action === 'version') { console.log(VERSION); return; }
   const configured = process.env.FOUNDATION_URL || await savedUrl();
   if (action === '--help' || action === '-h' || action === 'help' || !action) { console.log(HELP); return; }
-  if (action === 'guide') {
-    if (configured) {
-      try {
-        const response = await fetch(new URL('/start', serverUrl(configured)), { redirect: 'error', signal: AbortSignal.timeout(5_000) });
-        if (!response.ok || response.headers.get('content-type')?.split(';')[0].trim() !== 'text/plain') throw new Error('Guide unavailable');
-        const instructions = await response.text();
-        if (!instructions.trim()) throw new Error('Empty guide');
-        console.log(instructions.trimEnd());
-        return;
-      } catch {}
-    }
-    console.error(`${configured ? 'Could not read the server guide.' : 'No Foundation server configured.'} Using the bundled reference from CLI ${VERSION}; it may differ from your server.`);
-    console.log(guide());
-    return;
-  }
   const separatorAt = args.indexOf('--'), command = separatorAt >= 0 ? args.slice(separatorAt + 1) : [];
   // Names remain literal. Inputs inject bytes; an optional output saves one generated file.
   let names = [], output;
@@ -187,7 +172,8 @@ async function main() {
   }
   const url = serverUrl(connectTo ?? configured);
   const keyPath = process.env.FOUNDATION_RUNTIME_KEY_FILE || join(homedir(), '.local', 'state', 'foundation', createHash('sha256').update(url.origin).digest('hex').slice(0, 24) + (agentName ? '-' + agentName.toLowerCase().replace(/[^a-z0-9]+/g, '-') : '') + '.key');
-  let token = await readKey(keyPath, { missingOk: action === 'connect' });
+  const publicSpec = action === 'api' && call.method === 'GET' && call.target === '/openapi.json';
+  let token = publicSpec ? null : await readKey(keyPath, { missingOk: action === 'connect' });
   async function send(target, payload, { accept, method = 'POST', type = 'application/json' } = {}) {
     const response = await fetch(url.origin + target, { method, headers: { authorization: 'Bearer ' + token, ...(payload === undefined ? {} : { 'content-type': type }) },
       body: payload === undefined ? undefined : type === 'application/json' ? JSON.stringify(payload) : payload, redirect: 'error', signal: AbortSignal.timeout(30_000) });
@@ -197,11 +183,11 @@ async function main() {
   }
   // One request, with the key attached and the answer printed as it came. Nothing here knows the endpoints.
   if (action === 'api') {
-    if (!/[?&]as=/.test(call.target)) {
+    if (!publicSpec && !/[?&]as=/.test(call.target)) {
       const me = await send('/v1/principals/me', undefined, { method: 'GET', accept: () => true });
       if (me.acts_for?.length === 1) call.target += (call.target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(me.acts_for[0]);
     }
-    const response = await fetch(url.origin + call.target, { method: call.method, headers: { authorization: 'Bearer ' + token, ...(call.body === undefined ? {} : { 'content-type': call.type }) },
+    const response = await fetch(url.origin + call.target, { method: call.method, headers: { ...(token ? { authorization: 'Bearer ' + token } : {}), ...(call.body === undefined ? {} : { 'content-type': call.type }) },
       ...(call.body === undefined ? {} : { body: call.body }), redirect: 'error', signal: AbortSignal.timeout(30_000) });
     const bytes = Buffer.from(await response.arrayBuffer());
     process.stdout.write(bytes);

package/guide.mjs

@@ -1,225 +0,0 @@
-// Printed by `foundation guide` (and served to MCP clients): the one page an agent reads before using any of this.
-//
-// What Foundation offers is an HTTP API, and that is what this describes. Not every agent can run a
-// command, so nothing here assumes a shell; where one exists there is a small program that adds the one
-// thing HTTP cannot do, and it is described last.
-//
-// This text is read by the agent, not by the owner, so it is English; everything the owner reads
-// (purposes, steps, the dashboard) stays in the owner's language.
-// The services this server knows, each with the schemes it can be connected by.
-function serviceLines(services) {
-  if (!services) return ['     GET /v1/services lists the services this server knows.'];
-  return services.map(service => '     ' + service.id + '  ' + service.name + '  ' + Object.entries(service.auth_schemes)
-    .map(([id, scheme]) => id + (id === 'oauth' ? (scheme.foundation_app ? ' (Foundation\'s app)' : scheme.takes_apps ? ' (owner\'s app)' : '') : id === 'role' && !scheme.available ? ' (unavailable)' : '')).join(', '));
-}
-
-export function guide(services) {
-  return ['Foundation holds, for each principal, credentials and objects, and runs explicitly requested built-in functions.',
-    'A credential lets something act at a service on its holder\'s behalf. It is either for a service Foundation knows,',
-    'by one of that service\'s schemes - oauth (the holder said yes at the service), token (the holder made a token there and',
-    'handed it over) or role (the holder made a role for Foundation to assume) - or a secret: bytes the holder handed over',
-    'for no service in particular. An object is bytes placed here. Reading never reaches a service. Injecting a credential',
-    'derives what it yields now: a secret its bytes, the others what their scheme obtains. A name is the holder\'s word for',
-    'a thing; it decides no service, function or variable.', '',
-    'Everything below is HTTP with your approved key: Authorization: Bearer fdn_...',
-    'Nothing here needs a shell. With one, use foundation api to attach the key and foundation exec to inject values',
-    'into a command. api prints responses: use function save options when output should not enter your context.',
-    'Never ask the owner to paste passwords, keys or tokens into chat. Use a request instead.', '',
-    'WHO YOU ARE',
-    '   Everything that comes to Foundation is a principal: a person, an AI, an app. You are one, and your access key is',
-    '   what proves it. Foundation issues it, once, and shows it once: keep it private and never print it. If you can',
-    '   write a private file, keep it there; otherwise keep it wherever your secrets go.',
-    '   POST /v1/principals  {"name": "<what to call you>"}   with no key at all. Makes you, and answers with token.',
-    '   What you may reach follows from lines between principals: whoever you act for (actor), whoever made you (owner).',
-    '   POST /v1/requests  {"kind": "actor", "input": {"name": "<what to call you>"}}   with your key as the bearer.',
-    '     Asks whoever opens it to let you act for them. Returns verification_uri and confirmation_code. Give the person',
-    '     both; they open the URL and type the code. Until they do you act for nobody. Retry GET /v1/principals/me every',
-    '     few seconds and look at acts_for. Do not hammer it.',
-    '   GET /v1/principals/me    who you are: principal, acts_for (whom you act for), owners, keys, your open requests.',
-    '     Every call below reaches your own resources unless you name whose: ?as=<id of one you act for>. The foundation',
-    '     CLI and the MCP tool add ?as= for you when you act for exactly one; over raw HTTP, add it yourself.',
-    '   PATCH /v1/principals/me {"name"}    DELETE /v1/principals/me    a new name; leaving (your key stops working).',
-    '   GET /v1/requests/<id>   one of your requests and what happened at its page (events).   DELETE cancels it.',
-    '   GET /v1/relations   every line you are on.   GET /v1/audit-log   what was done in your name or to you.',
-    '   Every resource has an id, shown in every listing. What a principal may do comes from lines drawn to it:',
-    '   POST /v1/relations {"subject":"<principal id>","relation":"<role or action>","object_type":"resource"|"principal","object_id":"<id>"}',
-    '     A role is viewer or editor onto a resource, or actor onto a principal (acting for it). An action is one the rules',
-    '     name, such as credential.disconnect, onto one resource or onto a principal (all it holds). One draws a line where',
-    '     one may give lines (share on a resource, relate on a principal) and may do all the line reaches. DELETE takes it',
-    '     back; anyone may step off a line drawn to them. Owning a principal is never drawn: it comes from making or approving.',
-    '   GET /v1/resources?shown=me   what others have shown you.   GET /v1/resources/<id>   one resource, whoever holds it.',
-    '   GET /v1/resources/<id>/content   reads it; PUT writes it, as editor. Lines point at the id, so renaming changes nothing.',
-    '',
-    'CREDENTIALS',
-    '   GET /v1/resources?kind=credential    every credential: id, name, status, and for one made for a service, its',
-    '     service, auth_scheme, facts and the variables it yields. &service=<id> narrows to one service; &secret=true to',
-    '     secrets, &secret=false to those for services; &prefix= by name.',
-    '   PUT /v1/resources?kind=credential&name=<name>    body: raw bytes, up to 1MB. A secret: the same exact name replaces',
-    '     that value; the answer carries its id.',
-    '     What you keep for the holder you may read back (an editor line is drawn for you). What the holder kept, or a',
-    '     service authorized, you may inject into a command but not read, unless the holder draws you a line.',
-    '     Do not print injected values into your context.',
-    '   GET /v1/resources?kind=credential&name=<name>   one secret by name: its id and metadata. 404 if no such name.',
-    '   GET /v1/resources/<id>/content    a secret\'s bytes, as written; 403 forbidden without a line to it. PUT writes them.',
-    '     A credential for a service has no content to read (405): what it yields is derived when injected.',
-    '   PATCH /v1/resources/<id> {"name"}    a new name.   DELETE /v1/resources/<id>   removes it (one for a service: see below).',
-    '   URL-encode the name. A name is any text, which is why it travels as a query and not as a path. Names are 1-200',
-    '   characters without control characters; case, spaces, slashes and punctuation remain literal.', '',
-    'HANDING IT TO A COMMAND',
-    '   POST /v1/injections  {"names": [{"name": "build token", "as": "GH_TOKEN"}, {"name": "<id of a credential for a service>"}]}',
-    '     Each item is {name, as, filename?}. name is a secret\'s name or any credential\'s id. For a secret, as is required:',
-    '     it names the environment variable. A credential for a service yields its scheme\'s variables (see variables); as',
-    '     may rename the one variable of a scheme that has exactly one. Injecting one may ask the service for a fresh',
-    '     token; expires_at says how long what came back is good.',
-    '     filename makes the bytes a temporary file instead; as holds its local path. Use this for binary or multiline data.',
-    '     Up to 16 inputs. Variables and filenames must be distinct; reserved system variables are refused.',
-    '     Returns injection: {environment, files}. Calling this into an agent context exposes values. Use exec when the',
-    '     intent is to run a local command.', '',
-    'SERVICES',
-    '   GET /v1/services   every service this server knows: its api, docs, console (where an app or a token for it is',
-    '   made) and auth_schemes. For each scheme: variables (what a credential yields), hint (how to use it), and',
-    '   - oauth: scopes (base and documentation_url), foundation_app (Foundation has its own app for it), takes_apps (the',
-    '     owner may bring their own app) and app_fields (what registering one asks for);',
-    '   - token: fields (what the owner types; secret ones are sealed);',
-    '   - role: available.',
-    ...serviceLines(services),
-    '   A service the list does not know can be described by the owner, or by you acting for them, as a resource:',
-    '   PUT /v1/resources?kind=service&name=<name>   body: its definition, the same JSON shape as a listed service',
-    '     {"version":1, "name", "api"?, "docs"?, "console"?, "auth_schemes": {"oauth"?: {...}, "token"?: {...}}}',
-    '     oauth: authorize, token (https URLs; {field} is filled from the app), injection {"VARIABLE":"{access_token}"...},',
-    '       and as the service needs them: scopes {base, docs}, scope_separator, pkce, client_auth (basic / body),',
-    '       token_format (form / json), ok_field, identity {url, id, label}, revoke {url, style: rfc7009 / bearer / delete},',
-    '       app_fields, authorize_params, keep. Placeholders: access_token, account, expires_at, kept fields, app fields.',
-    '     token: fields [{name, label, secret?, pattern?}], injection {"VARIABLE":"{field}"}, identity {url, headers, id, label}.',
-    '     A refusal (invalid_definition) says where. It is then connected like any other, by its resource id.', '',
-    'FILLING IN CREDENTIALS',
-    '',
-    '1. Put a secret there yourself. Anything you obtained or wrote: PUT /v1/resources?kind=credential&name=<name>, above.',
-    '',
-    '2. ASKING THE OWNER FOR A SECRET, for what only they can fetch and no listed service describes.',
-    '   POST /v1/requests  {"kind":"store", "input":{"fields":[{...}]}, "purpose":"...", "steps":["..."], "valid_minutes":30}',
-    '     fields[].name      suggested name; result.names returns the names the owner chose, result.replaced those replaced',
-    '     fields[].label     what they are being asked for, in their language. It titles the screen and names the field.',
-    '     fields[].site      the page where they make it, offered as a link',
-    '     fields[].readable  true asks to read it back afterwards (a viewer line); the default is that you cannot',
-    '     fields[].multiline true for something like a PEM',
-    '     fields[].replace   true to put the value in place of the one already kept under that exact name (rotation).',
-    '                     Refused at creation: name_taken when the name exists and replace is not declared, name_missing',
-    '                     when it is declared and nothing is there. The owner may still give it another name, in which',
-    '                     case nothing is replaced; result.replaced lists the names that were.',
-    '     purpose         one concrete sentence the owner can judge, in their language',
-    '     steps           what they do, one string per step (up to 20, 500 characters each, no line breaks). Foundation',
-    '                     holds no instructions for anyone else\'s site: look up what to click now, and write it yourself.',
-    '   Give the owner the verification_uri (there is no code). When they finish, it is simply kept.',
-    '   Ask for what the owner already holds. Never take it through the conversation and put it there yourself.',
-    '',
-    '3. CONNECTING A SERVICE, for a credential Foundation keeps (and, for OAuth, renews) itself.',
-    '   POST /v1/requests  {"kind":"connect", "input":{"service":"<id>", "auth_scheme":"oauth"|"token"|"role",',
-    '     "scopes":["<the service\'s scope>", ...]}, "purpose":"...", "steps":["..."], "valid_minutes":30}',
-    '     Give the owner the verification_uri. auth_scheme defaults to the service\'s first.',
-    '   Choose the scheme that fits the owner: OAuth through Foundation\'s app is the easiest when foundation_app is true.',
-    '   Otherwise a token the owner makes at the service (console) is often simplest for one person\'s own use; write the',
-    '   steps for making it. OAuth through the owner\'s own app suits an organization or scopes Foundation\'s app lacks.',
-    '   scopes (OAuth) are the service\'s own names for what the credential may do (scopes.documentation_url). Ask for',
-    '   what the work needs; the owner sees each one before agreeing. Foundation adds only the few it needs to know who',
-    '   authorized (scopes.base). facts.missing_scopes lists any the service did not grant.',
-    '   OAuth goes through an app: Foundation\'s own, or one the owner holds (or was lent).',
-    '   GET /v1/resources?kind=app   the apps the owner may connect through, Foundation\'s included (foundation: true).',
-    '   Add "app":"<app id>" inside input to connect through one; without it, Foundation\'s is used, or on reconnecting,',
-    '   the app the credential was made through. A request nobody could complete is refused (app_required): ask for an',
-    '   app first when the service has no Foundation app.',
-    '   POST /v1/requests  {"kind":"app", "input":{"service":"<id>"}, "purpose":"...", "steps":["..."]}   asks the owner',
-    '     to register one: they make it at the service (console; redirect URL <this server>/oauth/callback) and type its',
-    '     values on the page. result.app_id names it. You never see or handle its secret.',
-    '   To reconnect, add "credential_id":"<existing id>" inside input. This updates that credential and keeps its id,',
-    '   its scopes (add more with scopes) and the app it was made through. Without it, a new credential is made, even',
-    '   for the same account. List and use an existing credential when no new authorization is needed.',
-    '   A role (aws) has the owner make a role for Foundation in their own console and paste its name; nothing of theirs',
-    '   is kept but that name, and each injection obtains an hour of credentials.',
-    '   Poll GET /v1/requests/<id> every few seconds until done; result.credential_id identifies the credential.',
-    '   DELETE /v1/resources/<id> {"revoke": true|false}   disconnects one (the owner, in a browser); revoke also asks the',
-    '   service to withdraw what it granted. What was already handed out stays where it went.', '',
-    'ENVIRONMENTS (a machine with a shell, for when you have none)',
-    '   A lent machine: a shell, files and the network, thrown away when done. By itself it reaches nothing of Foundation.',
-    '   Give it an identity - a principal you may act as (yourself, one you own, or one you act for) - and it holds that',
-    '   principal\'s key for its life: inside, the foundation CLI works as that principal (foundation exec, foundation api).',
-    '   POST /v1/environments {"identity":"<principal id>"|null, "size":"small|medium|large",',
-    '     "lifetime":{"end":"idle|exit","idle_seconds":600,"max_seconds":3600}}   opens one; it is a resource (kind environment).',
-    '   POST /v1/environments/<id>/commands {"command":["npm","test"],"stdin":null,"timeout_seconds":300}',
-    '     runs one command: exit_code, stdout, stderr. 202 with status running if it takes longer; then',
-    '   GET /v1/environments/<id>/commands/<command id>.   One command at a time; files persist between commands.',
-    '   PATCH /v1/environments/<id> {"identity":… or null}   gives or takes away its identity.   DELETE closes it.',
-    '   POST /v1/runs {…as opening, plus "command"}   opens, runs one command, stops: the answer carries the result.',
-    '   What a command prints is cleaned of values handed in with injections. Keep what matters as an object.',
-    '   Computing is spent: GET /v1/principals/<id>/compute shows this month\'s use and limit; its owner may lower the',
-    '   limit with PUT {"monthly_seconds": n}. A medium machine spends twice its time, a large one four times.', '',
-    'FUNCTIONS',
-    '   GET /v1/functions   catalog of built-in operations and their invocation endpoints.', '',
-    'WHEN IT DOES NOT WORK',
-    '   GET /v1/requests/<id>   one of your requests, and what happened at its page (events).',
-    '   GET /v1/requests?status=pending   your requests. Several may be open at once (up to 10).',
-    '   events is the raw record, in order: page_opened / page_viewed / connect_started / connect_failed (with a code and',
-    '   Foundation\'s own message) / connect_review (awaiting confirmation of changes) / connected / stored / denied / cancelled. What was typed is never recorded.',
-    '   DELETE /v1/requests/<id>   cancels it. status is pending / done / denied / cancelled.',
-    '   Completion and result are fixed until the request expires, even if the resulting resource changes or is removed.',
-    '   Current credential state is at GET /v1/resources?kind=credential. Revoked keys receive 401; their pending requests are cancelled.',
-    '   Request feedback expires with the request. A done result is a credential_id or the names saved at completion.',
-    '   Why a connection failed: invalid_fields (wrong shape) / token_refused (the service would not take the token) /',
-    '   reconnect_required (the service rejected it) / credential_changed (the target changed). A key approval shows its own events at',
-    '   GET /v1/requests/<id>: confirmation_required (a wrong code) / confirmation_locked (5 tries).', '',
-    'A PLACE FOR FILES (object storage the owner did not have to sign up for)',
-    '   PUT /v1/resources?kind=object&name=<key>   body is the bytes; the Content-Type you send is what a reader gets back. Up to 25MB.',
-    '   GET /v1/resources?kind=object&prefix=<p>   lists what is there, with ids. &name=<key> finds one.',
-    '   GET /v1/resources/<id>/content   the bytes. PUT writes them. DELETE /v1/resources/<id> removes it. PATCH renames it.',
-    '   POST /v1/resources/<id>/link {"minutes":n}   a time-limited URL anyone can read, for a thing that only takes a URL.',
-    '   Keys look like a path (a/b/c.txt) but name one whole object: no renaming, no directories, no partial reads or writes.',
-    '   This is not a filesystem. If the owner needs one, they need a machine to mount it on.',
-    '   Where the bytes live is the owner\'s business: a space lent to them now, a bucket of their own later. Nothing you call changes.', '',
-    'HTTPS REQUEST FUNCTION',
-    '   POST /v1/functions/http.request  {"url": "https://api.example.com/v1/items", "method": "POST",',
-    '     "headers": {"authorization": "Bearer {{foundation:token}}"}, "bindings": {"token": "build token"}, "body": "..."}',
-    '     Each placeholder identifies an input slot. bindings maps slots to credentials: a secret\'s exact name (including',
-    '     braces or spaces), or a credential\'s id (<id>#<VARIABLE> when it yields several). Without bindings, a slot',
-    '     is itself a name. Inputs only in headers/body, never in the URL. Up to 8 inputs. A bound credential for a service is',
-    '     derived first, so its service may be asked for a fresh token.',
-    '     body_encoding "base64" sends bytes without substitution.',
-    '     Returns {response: {status, headers, body, body_encoding}}. Common echoes of input secrets are redacted;',
-    '     do not treat redaction as protection against arbitrary transformations by an untrusted destination.',
-    '     Optional save: "<name>" keeps the response body as a secret and returns only status/headers and saved metadata.',
-    '     Redirects are returned, not followed.',
-    '     HTTPS on 443, public hostnames only, never this server or private networks. 1MB each way, 20 seconds, 30/minute.',
-    '     No workflow, schedule or implicit execution: the caller chooses each invocation and each saved output.', '',
-    'THE SHELL (only if you can run commands)',
-    '   Install: npm install -g @tomato414941/foundation   (Node.js 24 or later)',
-    '   foundation connect [<url>] [--name <name>]',
-    '     Makes the key as a private file and asks for approval. The key is never printed, so it never reaches you.',
-    '     Given a URL, it also remembers that server for every later command; run it again when the server moves.',
-    '   foundation api <GET|POST|PUT|DELETE|PATCH> </path> [--json <body>] [--from <file>] [--type <media-type>]',
-    '     Any request above, with the key attached and the answer printed as it came. Prefer this over curl: reading the key',
-    '     file to build a header yourself would put the key in your context, which is the thing this avoids.',
-    '   foundation exec <ENV>=<name> [...] -- <command> [args...]',
-    `   foundation exec --inputs '[{"name":"signing key","as":"KEY_FILE","filename":"AuthKey.p8"}]' -- <command>`,
-    '     ENV=name treats everything after the first = literally. Use --inputs JSON for files or structured inputs.',
-    '     Only the child process gets injected values; files exist only while it runs. FOUNDATION_NAMES is a JSON array',
-    '     of the exact saved names used. Prevent the child command from logging or echoing secrets.',
-    '     Use this instead of POST /v1/injections whenever the point is to run something.',
-    `   foundation exec --output '{"name":"login config","as":"AUTH_FILE","filename":"auth.json"}' -- <command>`,
-    '     Creates one empty private file and sets as to its path. Tell the command to write its authentication result there.',
-    '     After exit 0, keeps the file bytes as a secret under the exact name, then removes the temporary file.',
-    '     An existing value at that name is replaced. Output must be a private regular file containing 1 byte to 1MB.',
-    '     May be combined with inputs, using a different environment variable. A failed command never saves its output.',
-    '     If upload cannot be confirmed, exits with an error and reports the retained private file for recovery; inputs are',
-    '     still removed. Retry with api PUT --from, then remove the recovery file. Other temporary files are removed.',
-    '     Use native service login URLs; never collect passwords in chat. Stored credentials keep their original expiry.',
-    '   Environment: FOUNDATION_URL (optional; overrides the remembered server), FOUNDATION_AGENT (optional; your name, e.g. claude / codex), FOUNDATION_RUNTIME_KEY_FILE (optional).',
-    '   One key per machine and OS user by default. FOUNDATION_AGENT gives each agent its own key, but any agent running as the',
-    '   same OS user can read that file, so it is bookkeeping, not protection. To separate them for real, use separate OS users.', '',
-    'RULES',
-    '- Never print, log or write out what is injected. Hand it to a command, and nowhere else.',
-    '- Send saved values only to an authorized destination. http.request and exec use the destinations you choose.',
-    '- Ask for the least you need. Do not request something the work does not use.',
-    '- Be honest in name, purpose and label. The owner decides based on them.',
-    '- If a request is denied or expires, ask the owner why rather than guessing.',
-    '- Use what you receive only for the work it was asked for.',
-  ].join('\n');
-}