From 628e45e26064dc84938b7c118fc40b1ffed0a93d Mon Sep 17 00:00:00 2001 From: NNIIOVO Date: Tue, 10 Nov 2026 15:51:41 -0600 Subject: [PATCH] docs(agent keys): drop leftover mentions of the Claude app's chat side Since ADR-0013 step 3 (#113) the key route answers only Claude Code (including the Claude app's Code tab) and the Codex command-line tool, and the setup script no longer prints a Claude app chat config. Three lines still named the Claude app as if its chat side were a client: - docs/agent-keys.md, removing the setup: delete the tool from ~/.codex/config.toml, not from a "Claude app config". - docs/agent-keys.md, status: "from Claude Code (in Terminal or the Claude app's Code tab) or Codex". - crates/agent-keys-mcp/src/lib.rs, a doc comment on client timeouts: only Codex is named now. No code change. ADR-0012 keeps its original wording; ADR-0013 narrows it. Co-Authored-By: Claude Opus 5.5 --- crates/agent-keys-mcp/src/lib.rs | 2 +- docs/agent-keys.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crates/agent-keys-mcp/src/lib.rs b/crates/agent-keys-mcp/src/lib.rs index a87efb8..030a800 100644 --- a/crates/agent-keys-mcp/src/lib.rs +++ b/crates/agent-keys-mcp/src/lib.rs @@ -17,7 +17,7 @@ //! `notifications/initialized`, `ping`, `tools/list` and `tools/call`. //! //! A request that waits for the owner can take up to 5 minutes, longer than some clients wait -//! for a tool (Codex and the Claude app give up after 60 s by default). So the binary answers +//! for a tool (Codex gives up after 60 s by default). So the binary answers //! each `tools/call` on its own thread, and other calls (`ping`, `list_keys`) are answered //! while one waits; and while one waits it sends `notifications/progress` every //! [`PROGRESS_EVERY`] when the client gave a `progressToken`, for clients that wait longer on diff --git a/docs/agent-keys.md b/docs/agent-keys.md index 82c6a1b..4ca1991 100644 --- a/docs/agent-keys.md +++ b/docs/agent-keys.md @@ -2,7 +2,7 @@ > **Don't put real keys in through an agent yet.** > -> **Status:** built 2026-11-06 and checked with fictional data only, in automated tests and in the screens' fixture. The check that only Claude Code and Codex are answered ([ADR-0013](adr/0013-only-claude-code-and-codex-use-the-agent-routes.md)) was added 2026-11-09, also checked with fictional data and stand-in programs only. Nobody has yet run it on a real Mac with a real separate agent account, used it from Claude Code, Codex or the Claude app, or seen its native panels and its window coming to the front. The fake-key drill and the security review that [ADR-0012](adr/0012-agents-store-and-manage-keys.md#build-order) asks for before real keys (steps 5 and 6) are still to do. Mac only. Each step marked **Owner** is yours to do; nothing in the app does it for you. +> **Status:** built 2026-11-06 and checked with fictional data only, in automated tests and in the screens' fixture. The check that only Claude Code and Codex are answered ([ADR-0013](adr/0013-only-claude-code-and-codex-use-the-agent-routes.md)) was added 2026-11-09, also checked with fictional data and stand-in programs only. Nobody has yet run it on a real Mac with a real separate agent account, used it from Claude Code (in Terminal or the Claude app's Code tab) or Codex, or seen its native panels and its window coming to the front. The fake-key drill and the security review that [ADR-0012](adr/0012-agents-store-and-manage-keys.md#build-order) asks for before real keys (steps 5 and 6) are still to do. Mac only. Each step marked **Owner** is yours to do; nothing in the app does it for you. While you let it, an AI agent running in **one separate standard Mac account** can ask encrypted-note to store a key. The app comes to the front with its editor filled in from what the agent suggested (Kind, name, visible details). You type or paste the value there and choose Save. The agent gets back only "saved" and the key's id, or "cancelled". It never sees the value, and it can't use the key. @@ -160,7 +160,7 @@ The agent then has five tools: `store_key`, `list_keys`, `edit_key_details`, `as ## Stop and clean up - **Stop** in Settings ends the grant at once and cancels any request still waiting. Stop, a lock and quitting all remove the socket. -- To remove the setup: choose **Stop**, then in the agent account remove the tool (`claude mcp remove --scope user enote-keys`, or delete its lines from the Codex or Claude app config). In your own account, delete the folder with `rm -r /Users/Shared/encrypted-note-keys` and the tool with `sudo rm /usr/local/bin/enote-agent-keys`, and clear the agent's Mac user in Settings. The keys an agent added stay in your Vault, still marked; choose **Stop agent managing this** on each if you like. +- To remove the setup: choose **Stop**, then in the agent account remove the tool (`claude mcp remove --scope user enote-keys`, or delete the `[mcp_servers.enote-keys]` lines from `~/.codex/config.toml`). In your own account, delete the folder with `rm -r /Users/Shared/encrypted-note-keys` and the tool with `sudo rm /usr/local/bin/enote-agent-keys`, and clear the agent's Mac user in Settings. The keys an agent added stay in your Vault, still marked; choose **Stop agent managing this** on each if you like. ## For developers: trying it with a fictional Vault