From 71c85f7ef5440f051a328fe85105b8e9346133bf Mon Sep 17 00:00:00 2001 From: Petr Date: Wed, 6 May 2026 21:13:35 +0200 Subject: [PATCH] docs: address 0.29.0 silent-drift cleanup leftovers Three nits found by post-release audit against CONTRIBUTING.md 'Plugin synchronization map': - D-1: CLAUDE.md convention #12 'Default-deny since 0.28.0' was a stale label from the relabel sweep (the manage-token default-deny shipped in 0.29.0). Bump to 0.29.0. - D-2: SKILL.md description block missed trigger keywords for the three new 0.29.0 topic areas: * data-app secrets (secrets-set/list/get/remove, encrypt app secret) * data-app validate-repo (golden rule, pre-flight repo check) * manage-token default-deny (--allow-env-manage-token) Without these, description-based auto-trigger won't fire when the user mentions any of these features by name. - D-3: SKILL.md had a duplicated 'local workspace, project directory, kbagent init.' line (two consecutive copies, one with period, one with comma). Kept the comma variant; trailing period correctly moves to the last keyword in the list. No code or behavior changes. Pure documentation. --- CLAUDE.md | 2 +- plugins/kbagent/skills/kbagent/SKILL.md | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index d66ba47d..90ca492e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -195,7 +195,7 @@ All three inherit from `BaseHttpClient` (`http_base.py`) which provides shared r 11. **Error accumulation**: multi-project operations collect per-project errors without stopping. One project failing doesn't block others (see `lineage_service.py`, `org_service.py`). -12. **Manage token security**: never persisted, never passed as CLI argument, never logged. Default-deny since 0.28.0: only via interactive hidden prompt; the `KBC_MANAGE_API_TOKEN` env var is **ignored** unless the top-level `--allow-env-manage-token` flag is passed. Default-deny closes the AI-exfiltration risk where any subprocess (including the AI agent itself) inherits the manage token via env. CI/CD callers must opt in explicitly. +12. **Manage token security**: never persisted, never passed as CLI argument, never logged. Default-deny since 0.29.0: only via interactive hidden prompt; the `KBC_MANAGE_API_TOKEN` env var is **ignored** unless the top-level `--allow-env-manage-token` flag is passed. Default-deny closes the AI-exfiltration risk where any subprocess (including the AI agent itself) inherits the manage token via env. CI/CD callers must opt in explicitly. 13. **Idempotency**: `org setup` skips already-registered projects by matching `project_id`. Safe to re-run. diff --git a/plugins/kbagent/skills/kbagent/SKILL.md b/plugins/kbagent/skills/kbagent/SKILL.md index 649656aa..f4a73f40 100644 --- a/plugins/kbagent/skills/kbagent/SKILL.md +++ b/plugins/kbagent/skills/kbagent/SKILL.md @@ -30,11 +30,15 @@ description: > data-app create, data-app deploy, data-app password, data-app start, app proxy, simpleAuth, app auto-suspend, configVersion, redeploy contract, Data Science API, /apps endpoint, app password, KBC::Project ciphertext, - local workspace, project directory, kbagent init. + data-app secrets, app secrets, app runtime secrets, secrets-set, + secrets-list, secrets-get, secrets-remove, encrypt app secret, + app environment variable, validate repo, validate-repo, + data-app golden rule, pre-flight repo check, repo structure check, local workspace, project directory, kbagent init, invite user, invite member, project invitation, manage members, list members, remove member, change role, project role, - bulk invite, invite from CSV, project access, member management. + bulk invite, invite from CSV, project access, member management, + manage token prompt, --allow-env-manage-token, KBC_MANAGE_API_TOKEN. --- # kbagent -- Keboola Agent CLI