agent-canvas 0.1.41 → 0.1.42

package/daemon/src/compiler.test.ts

@@ -37,3 +37,8 @@ test("well-formed canvas compiles", async () => {
   const result = await compilePlan(`<Section title="Hello"><Item id="a" label="b">text</Item></Section>`);
   expect(result.ok).toBe(true);
 });
+
+test("runbook secret input compiles", async () => {
+  const result = await compilePlan(`<SecretInput id="service-token" label="Service token" env="SERVICE_TOKEN" required />`);
+  expect(result.ok).toBe(true);
+});

package/daemon/src/compiler.ts

@@ -14,7 +14,7 @@ const COMPONENT_IMPORTS = `import React from 'react';
 import * as C from '#canvas/components';
 const { Section, Item, Task, FilePreview, CodeBlock, Callout,
         Mermaid, Table, Priority, Checklist, Note, Diff,
-        Choice, MultiChoice, UserInput, RangeInput, ImageView,
+        Choice, MultiChoice, UserInput, RangeInput, SecretInput, ImageView,
         Markdown, useFeedback, useAnnotations } = C;
 `;
 
@@ -40,7 +40,7 @@ const STUB_COMPONENTS: Record<string, any> = {};
 for (const name of [
   "Section", "Item", "Task", "FilePreview", "CodeBlock", "Callout",
   "Table", "Priority", "Checklist", "Note", "Diff",
-  "Choice", "MultiChoice", "UserInput", "RangeInput", "ImageView", "Markdown",
+  "Choice", "MultiChoice", "UserInput", "RangeInput", "SecretInput", "ImageView", "Markdown",
 ]) {
   STUB_COMPONENTS[name] = Stub;
 }

package/daemon/src/handlers/api.ts

@@ -6,12 +6,31 @@ import { jsonResponse } from "./utils";
 import { loadShareConfig, shareRevision, revokeShare } from "../share";
 import type { Route } from "../router";
 
+const SECRET_FIELD_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const MAX_SECRET_BYTES = 64 * 1024;
+const MAX_RESOLVED_SECRETS = 32;
+
+function secretJsonResponse(data: unknown, status = 200): Response {
+  const response = jsonResponse(data, status);
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isValidSecretField(fieldId: string): boolean {
+  return SECRET_FIELD_RE.test(fieldId);
+}
+
 export interface ApiContext {
   sessionManager: SessionManager;
   broadcastPlanUpdate: (id: string) => void;
   broadcastRevisionUpdate: (id: string) => void;
   port: number;
   version: string;
+  cliAuthToken: string;
 }
 
 export function createApiHandlers(ctx: ApiContext): Route[] {
@@ -242,6 +261,64 @@ export function createApiHandlers(ctx: ApiContext): Route[] {
     return jsonResponse({ found: true, revision: result.revision, feedback: result.feedback });
   }
 
+  async function handleSecretStore(req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
+    const sessionId = match.pathname.groups.id!;
+    const fieldId = match.pathname.groups.field!;
+    if (!sessionManager.get(sessionId)) return secretJsonResponse({ error: "Session not found" }, 404);
+    if (!isValidSecretField(fieldId)) return secretJsonResponse({ error: "Invalid secret field ID" }, 400);
+
+    const raw: unknown = await req.json();
+    if (!isRecord(raw) || typeof raw.value !== "string" || raw.value.length === 0) {
+      return secretJsonResponse({ error: "Secret value must be a non-empty string" }, 400);
+    }
+    if (new TextEncoder().encode(raw.value).byteLength > MAX_SECRET_BYTES) {
+      return secretJsonResponse({ error: `Secret exceeds ${MAX_SECRET_BYTES} bytes` }, 413);
+    }
+
+    sessionManager.setSecret(sessionId, fieldId, raw.value);
+    return secretJsonResponse({ ok: true, ready: true });
+  }
+
+  function handleSecretStatus(_req: Request, _url: URL, match: URLPatternResult): Response {
+    const sessionId = match.pathname.groups.id!;
+    const fieldId = match.pathname.groups.field!;
+    if (!sessionManager.get(sessionId)) return secretJsonResponse({ error: "Session not found" }, 404);
+    if (!isValidSecretField(fieldId)) return secretJsonResponse({ error: "Invalid secret field ID" }, 400);
+    return secretJsonResponse({ ready: sessionManager.hasSecret(sessionId, fieldId) });
+  }
+
+  function handleSecretClear(_req: Request, _url: URL, match: URLPatternResult): Response {
+    const sessionId = match.pathname.groups.id!;
+    const fieldId = match.pathname.groups.field!;
+    if (!sessionManager.get(sessionId)) return secretJsonResponse({ error: "Session not found" }, 404);
+    if (!isValidSecretField(fieldId)) return secretJsonResponse({ error: "Invalid secret field ID" }, 400);
+    sessionManager.clearSecret(sessionId, fieldId);
+    return secretJsonResponse({ ok: true, ready: false });
+  }
+
+  async function handleSecretResolve(req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
+    if (req.headers.get("X-Agent-Canvas-CLI-Token") !== ctx.cliAuthToken) {
+      return secretJsonResponse({ error: "Secret resolution is available only to the local CLI" }, 403);
+    }
+    const sessionId = match.pathname.groups.id!;
+    if (!sessionManager.get(sessionId)) return secretJsonResponse({ error: "Session not found" }, 404);
+
+    const raw: unknown = await req.json();
+    const fields = isRecord(raw) && Array.isArray(raw.fields) ? raw.fields : null;
+    if (!fields || fields.length === 0 || fields.length > MAX_RESOLVED_SECRETS || !fields.every((field) => typeof field === "string" && isValidSecretField(field))) {
+      return secretJsonResponse({ error: `fields must contain 1-${MAX_RESOLVED_SECRETS} valid secret field IDs` }, 400);
+    }
+
+    const uniqueFields = [...new Set(fields)];
+    const result = sessionManager.resolveSecrets(sessionId, uniqueFields);
+    if (!result) return secretJsonResponse({ error: "Session not found" }, 404);
+    if (!result.ok) return secretJsonResponse({ error: "Required secrets are not ready", missing: result.missing }, 409);
+
+    return secretJsonResponse({
+      values: [...result.values].map(([id, value]) => ({ id, value })),
+    });
+  }
+
   return [
     { method: "GET", pattern: new URLPattern({ pathname: "/health" }), handler: handleHealth },
     { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/plan" }), handler: handlePlanPost },
@@ -249,6 +326,10 @@ export function createApiHandlers(ctx: ApiContext): Route[] {
     { method: "GET", pattern: new URLPattern({ pathname: "/api/session/:id/meta" }), handler: handleMeta },
     { method: "GET", pattern: new URLPattern({ pathname: "/api/session/:id/revision/:rev/feedback" }), handler: handleFeedbackGet },
     { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/feedback/consume" }), handler: handleFeedbackConsume },
+    { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/secrets/resolve" }), handler: handleSecretResolve },
+    { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/secrets/:field/value" }), handler: handleSecretStore },
+    { method: "GET", pattern: new URLPattern({ pathname: "/api/session/:id/secrets/:field/status" }), handler: handleSecretStatus },
+    { method: "DELETE", pattern: new URLPattern({ pathname: "/api/session/:id/secrets/:field/value" }), handler: handleSecretClear },
     { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/revision/:rev/share" }), handler: handleShareRevision },
     { method: "POST", pattern: new URLPattern({ pathname: "/api/session/:id/shares/:shareId/revoke" }), handler: handleShareRevoke },
     { method: "GET", pattern: new URLPattern({ pathname: "/api/session/:id/shares" }), handler: handleSharesList },

package/daemon/src/handlers/utils.ts

@@ -8,7 +8,7 @@ export function jsonResponse(data: unknown, status = 200): Response {
 export function corsHeaders(port: number): Record<string, string> {
   return {
     "Access-Control-Allow-Origin": "http://localhost:" + port,
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type",
   };
 }

package/daemon/src/paths.ts

@@ -14,6 +14,9 @@ export const TEMP_DIR = join(tmpdir(), "agent-canvas");
 /** PID file for daemon process */
 export const PID_FILE = join(TEMP_DIR, "daemon.pid");
 
+/** Capability used only by the CLI to resolve secret values */
+export const CLI_AUTH_FILE = join(TEMP_DIR, "daemon-auth-token");
+
 /** Temp dir for JSX compilation */
 export const COMPILE_TEMP_DIR = join(TEMP_DIR, "compile");
 

package/daemon/src/secrets-api.test.ts

@@ -0,0 +1,123 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { createApiHandlers } from "./handlers/api";
+import { dispatch, type Route } from "./router";
+import { SessionManager } from "./session";
+
+const testDirectories: string[] = [];
+
+function setup(): { routes: Route[]; sessionId: string } {
+  const directory = mkdtempSync(join(tmpdir(), "agent-canvas-secret-api-"));
+  testDirectories.push(directory);
+  const sessionManager = new SessionManager(directory);
+  const sessionId = "runbook";
+  sessionManager.upsert(sessionId, new Map([["runbook.jsx", "<Section title=\"Runbook\" />"]]), process.cwd());
+  const routes = createApiHandlers({
+    sessionManager,
+    broadcastPlanUpdate: () => {},
+    broadcastRevisionUpdate: () => {},
+    port: 19400,
+    version: "test",
+    cliAuthToken: "test-cli-capability",
+  });
+  return { routes, sessionId };
+}
+
+async function call(routes: Route[], method: string, path: string, body?: unknown): Promise<Response> {
+  const url = new URL(`http://localhost:19400${path}`);
+  const request = new Request(url, {
+    method,
+    ...(body === undefined
+      ? {}
+      : { headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }),
+  });
+  const response = dispatch(routes, request, url);
+  if (!response) throw new Error(`No route for ${method} ${path}`);
+  return response;
+}
+
+afterEach(() => {
+  for (const directory of testDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+describe("local secret API", () => {
+  test("stores readiness metadata separately from the resolved value", async () => {
+    const { routes, sessionId } = setup();
+    const base = `/api/session/${sessionId}/secrets/service-token`;
+
+    const stored = await call(routes, "POST", `${base}/value`, { value: "test-secret-value" });
+    expect(stored.status).toBe(200);
+    expect(stored.headers.get("Cache-Control")).toBe("no-store");
+
+    const status = await call(routes, "GET", `${base}/status`);
+    const statusText = await status.text();
+    expect(statusText).toContain('"ready":true');
+    expect(statusText).not.toContain("test-secret-value");
+
+    const resolveUrl = new URL(`http://localhost:19400/api/session/${sessionId}/secrets/resolve`);
+    const resolveRequest = new Request(resolveUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Agent-Canvas-CLI-Token": "test-cli-capability",
+      },
+      body: JSON.stringify({ fields: ["service-token"] }),
+    });
+    const resolveResponse = dispatch(routes, resolveRequest, resolveUrl);
+    if (!resolveResponse) throw new Error("No secret resolve route");
+    const resolved = await resolveResponse;
+    expect(await resolved.json()).toEqual({
+      values: [{ id: "service-token", value: "test-secret-value" }],
+    });
+  });
+
+  test("returns missing field IDs without partial secret values", async () => {
+    const { routes, sessionId } = setup();
+    await call(routes, "POST", `/api/session/${sessionId}/secrets/ready-token/value`, { value: "available" });
+
+    const url = new URL(`http://localhost:19400/api/session/${sessionId}/secrets/resolve`);
+    const request = new Request(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Agent-Canvas-CLI-Token": "test-cli-capability",
+      },
+      body: JSON.stringify({ fields: ["ready-token", "missing-token"] }),
+    });
+    const routed = dispatch(routes, request, url);
+    if (!routed) throw new Error("No secret resolve route");
+    const response = await routed;
+
+    expect(response.status).toBe(409);
+    expect(await response.json()).toEqual({
+      error: "Required secrets are not ready",
+      missing: ["missing-token"],
+    });
+  });
+
+  test("clears a stored value without returning it", async () => {
+    const { routes, sessionId } = setup();
+    const base = `/api/session/${sessionId}/secrets/service-token`;
+    await call(routes, "POST", `${base}/value`, { value: "test-secret-value" });
+
+    const cleared = await call(routes, "DELETE", `${base}/value`);
+    expect(await cleared.json()).toEqual({ ok: true, ready: false });
+    expect(await (await call(routes, "GET", `${base}/status`)).json()).toEqual({ ready: false });
+  });
+
+  test("does not expose resolved values to same-origin browser code", async () => {
+    const { routes, sessionId } = setup();
+    await call(routes, "POST", `/api/session/${sessionId}/secrets/service-token/value`, { value: "test-secret-value" });
+
+    const response = await call(routes, "POST", `/api/session/${sessionId}/secrets/resolve`, {
+      fields: ["service-token"],
+    });
+
+    expect(response.status).toBe(403);
+    expect(await response.text()).not.toContain("test-secret-value");
+  });
+});

package/daemon/src/server.ts

@@ -1,6 +1,7 @@
-import { writeFileSync, mkdirSync, readFileSync } from "fs";
+import { writeFileSync, mkdirSync, readFileSync, chmodSync } from "fs";
 import { join, dirname } from "path";
 import { tmpdir } from "os";
+import { randomBytes } from "crypto";
 import { SessionManager } from "./session";
 import { createWebSocketManager, type WSData } from "./websocket";
 import { dispatch } from "./router";
@@ -10,20 +11,25 @@ import { createFileHandlers } from "./handlers/files";
 import { createStaticHandlers } from "./handlers/static";
 import { createUploadHandlers } from "./handlers/uploads";
 import { startRemoteFeedbackPoller } from "./remote-feedback";
+import { CLI_AUTH_FILE } from "./paths";
 
 const PORT = parseInt(process.env.CANVAS_PORT || "19400", 10);
 const VERSION = JSON.parse(readFileSync(join(dirname(import.meta.dir), "..", "package.json"), "utf-8")).version as string;
 
 // Write PID file so CLI can find and stop us
 const pidDir = join(tmpdir(), "agent-canvas");
-mkdirSync(pidDir, { recursive: true });
+mkdirSync(pidDir, { recursive: true, mode: 0o700 });
+chmodSync(pidDir, 0o700);
 writeFileSync(join(pidDir, "daemon.pid"), String(process.pid));
+const cliAuthToken = randomBytes(32).toString("base64url");
+writeFileSync(CLI_AUTH_FILE, cliAuthToken, { mode: 0o600 });
+chmodSync(CLI_AUTH_FILE, 0o600);
 
 const sessionManager = new SessionManager();
 const wsManager = createWebSocketManager(sessionManager);
 
 const routes = [
-  ...createApiHandlers({ sessionManager, broadcastPlanUpdate: wsManager.broadcastPlanUpdate, broadcastRevisionUpdate: wsManager.broadcastRevisionUpdate, port: PORT, version: VERSION }),
+  ...createApiHandlers({ sessionManager, broadcastPlanUpdate: wsManager.broadcastPlanUpdate, broadcastRevisionUpdate: wsManager.broadcastRevisionUpdate, port: PORT, version: VERSION, cliAuthToken }),
   ...createFileHandlers(sessionManager),
   ...createUploadHandlers(sessionManager),
   ...createStaticHandlers(),
@@ -81,8 +87,6 @@ const server = Bun.serve<WSData>({
 export { sessionManager, server };
 export const broadcastPlanUpdate = wsManager.broadcastPlanUpdate;
 
-setInterval(() => sessionManager.cleanupStale(), 60 * 60 * 1000);
-
 // Start polling for remote feedback from shared canvases.
 // No-ops if CANVAS_SHARE_ENDPOINT is not set.
 startRemoteFeedbackPoller(sessionManager, wsManager.broadcastRemoteFeedback, VERSION);

package/daemon/src/session-secrets.test.ts

@@ -0,0 +1,83 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { SessionManager } from "./session";
+
+const testDirectories: string[] = [];
+
+function createManager(): SessionManager {
+  const directory = mkdtempSync(join(tmpdir(), "agent-canvas-secrets-"));
+  testDirectories.push(directory);
+  return new SessionManager(directory);
+}
+
+function createSession(manager: SessionManager, id = "runbook"): void {
+  manager.upsert(id, new Map([["runbook.jsx", "<Section title=\"Runbook\" />"]]), process.cwd());
+}
+
+function readTextFiles(directory: string): string {
+  const parts: string[] = [];
+  for (const entry of readdirSync(directory)) {
+    const path = join(directory, entry);
+    if (statSync(path).isDirectory()) {
+      parts.push(readTextFiles(path));
+    } else {
+      parts.push(readFileSync(path, "utf-8"));
+    }
+  }
+  return parts.join("\n");
+}
+
+afterEach(() => {
+  for (const directory of testDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+describe("session secret vault", () => {
+  test("resolves a deposited secret without persisting it", () => {
+    const manager = createManager();
+    createSession(manager);
+
+    expect(manager.setSecret("runbook", "service-token", "test-secret-value")).toBe(true);
+    expect(manager.hasSecret("runbook", "service-token")).toBe(true);
+    expect(manager.resolveSecrets("runbook", ["service-token"])).toEqual({
+      ok: true,
+      values: new Map([["service-token", "test-secret-value"]]),
+    });
+    expect(readTextFiles(testDirectories[0])).not.toContain("test-secret-value");
+  });
+
+  test("reports every missing field without returning partial values", () => {
+    const manager = createManager();
+    createSession(manager);
+    manager.setSecret("runbook", "ready-token", "available");
+
+    expect(manager.resolveSecrets("runbook", ["ready-token", "missing-token"])).toEqual({
+      ok: false,
+      missing: ["missing-token"],
+    });
+  });
+
+  test("clears secrets when a new revision is pushed", () => {
+    const manager = createManager();
+    createSession(manager);
+    manager.setSecret("runbook", "service-token", "test-secret-value");
+
+    manager.upsert("runbook", new Map([["runbook.jsx", "<Section title=\"Updated\" />"]]), process.cwd());
+
+    expect(manager.hasSecret("runbook", "service-token")).toBe(false);
+  });
+
+  test("clears one field without affecting the rest", () => {
+    const manager = createManager();
+    createSession(manager);
+    manager.setSecret("runbook", "first-token", "first");
+    manager.setSecret("runbook", "second-token", "second");
+
+    expect(manager.clearSecret("runbook", "first-token")).toBe(true);
+    expect(manager.hasSecret("runbook", "first-token")).toBe(false);
+    expect(manager.hasSecret("runbook", "second-token")).toBe(true);
+  });
+});

package/daemon/src/session.ts

@@ -96,6 +96,10 @@ export interface SessionData {
   shares?: ShareEntry[];
 }
 
+export type SecretResolution =
+  | { ok: true; values: Map<string, string> }
+  | { ok: false; missing: string[] };
+
 interface SessionMeta {
   projectRoot: string;
   createdAt: string;
@@ -125,8 +129,6 @@ interface LegacyRevisionInfo {
   diffStats?: DiffStats;
 }
 
-const STALE_TIMEOUT_MS = 24 * 60 * 60 * 1000; // 24 hours
-
 function computeLineDiffStats(oldText: string, newText: string): DiffStats {
   const oldLines = oldText.split("\n");
   const newLines = newText.split("\n");
@@ -150,6 +152,7 @@ function computeLineDiffStats(oldText: string, newText: string): DiffStats {
 
 export class SessionManager {
   private sessions = new Map<string, SessionData>();
+  private sessionSecrets = new Map<string, { revision: number; values: Map<string, string> }>();
   private readonly sessionsDir: string;
 
   /**
@@ -336,6 +339,7 @@ export class SessionManager {
   upsert(id: string, canvasFiles: Map<string, string>, projectRoot: string, label?: string, response?: string): SessionData {
     const existing = this.sessions.get(id);
     const now = new Date().toISOString();
+    // Stable session IDs must never recycle revision numbers used as browser draft keys.
     const revision = existing ? existing.currentRevision + 1 : 1;
 
     // Compute per-file diffStats against the previous revision
@@ -383,6 +387,8 @@ export class SessionManager {
       updatedAt: now,
     };
 
+    // Secrets belong to one revision and must never carry into a new runbook.
+    this.sessionSecrets.delete(id);
     this.sessions.set(id, session);
     this.persistToDisk(session, canvasFiles);
     return session;
@@ -454,9 +460,56 @@ export class SessionManager {
 
   remove(id: string) {
     this.sessions.delete(id);
+    this.sessionSecrets.delete(id);
     rmSync(this.sessionDir(id), { recursive: true, force: true });
   }
 
+  setSecret(id: string, fieldId: string, value: string): boolean {
+    const session = this.sessions.get(id);
+    if (!session) return false;
+
+    let secrets = this.sessionSecrets.get(id);
+    if (!secrets || secrets.revision !== session.currentRevision) {
+      secrets = { revision: session.currentRevision, values: new Map() };
+      this.sessionSecrets.set(id, secrets);
+    }
+    secrets.values.set(fieldId, value);
+    return true;
+  }
+
+  hasSecret(id: string, fieldId: string): boolean {
+    const session = this.sessions.get(id);
+    const secrets = this.sessionSecrets.get(id);
+    return !!session
+      && secrets?.revision === session.currentRevision
+      && secrets.values.has(fieldId);
+  }
+
+  clearSecret(id: string, fieldId: string): boolean {
+    const session = this.sessions.get(id);
+    const secrets = this.sessionSecrets.get(id);
+    if (!session || secrets?.revision !== session.currentRevision) return false;
+    return secrets.values.delete(fieldId);
+  }
+
+  resolveSecrets(id: string, fieldIds: string[]): SecretResolution | null {
+    const session = this.sessions.get(id);
+    if (!session) return null;
+
+    const secrets = this.sessionSecrets.get(id);
+    const missing = fieldIds.filter((fieldId) =>
+      secrets?.revision !== session.currentRevision || !secrets.values.has(fieldId)
+    );
+    if (missing.length > 0) return { ok: false, missing };
+
+    const values = new Map<string, string>();
+    for (const fieldId of fieldIds) {
+      const value = secrets?.values.get(fieldId);
+      if (value !== undefined) values.set(fieldId, value);
+    }
+    return { ok: true, values };
+  }
+
   saveCompiled(id: string, filename: string, js: string, rev?: number) {
     const session = this.sessions.get(id);
     const revision = rev ?? session?.currentRevision;
@@ -556,13 +609,4 @@ export class SessionManager {
       return [];
     }
   }
-
-  cleanupStale(maxAge = STALE_TIMEOUT_MS) {
-    const now = Date.now();
-    for (const [id, session] of this.sessions) {
-      if (now - new Date(session.updatedAt).getTime() > maxAge) {
-        this.remove(id);
-      }
-    }
-  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-canvas",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "description": "Interactive visual canvas for Claude Code — rich annotatable documents in the browser",
   "bin": {
     "agent-canvas": "bin/agent-canvas.js"

package/skills/canvas/SKILL.md

@@ -6,7 +6,8 @@ description: >
   comments, answers questions, and submits feedback.
 
   Supports planning, architecture reviews, code reviews, discovery interviews,
-  implementation summaries, proposals, decision documents, and explanations.
+  implementation summaries, proposals, decision documents, explanations, and
+  runbooks that hand local secrets to commands without putting values in context.
 disable-model-invocation: true
 
 ---