[nniiovoo]

Why

The README says the app gives AI agents "no way into your Vault". That's true of the app, but it never said that an AI tool running in your own account (Claude Code, Codex, Cursor) works as you. Separately, the Agent Companion told agents "unsupported response, try once more" when an answer was cut off at the 512-token limit, so a retry just fails the same way.

What changed

Docs: AI tools in your own account

• New section in docs/guide.md, "AI tools on this computer". It lists what such a tool may reach: Backups, the Vault folder (with when macOS asks first), Touch ID, the clipboard, the Agent Key and the screen. It covers Windows briefly.
• The safest setup: a separate standard account, not an administrator, and never signed in to your Apple Account. It also says what that does and doesn't keep apart, and that none of it is tested yet.
• Habits for running tools in your own account. It also says what to do after touching the Touch ID sensor for an unlock you didn't start: change those secrets, then use "Someone may know it", because a normal password change keeps the key.
• The Emergency Reader steps now suggest a Backup first, and quitting Terminal afterwards so its access ends.
• README.md: "the app itself", a short Important note that links to the section, and a line saying AGENTS.md is an instruction, not a lock.
• docs/security-model.md: "Doesn't protect" now names AI tools and other software running in your account.

Companion: a cut-off answer gets its own error

• companion/src/generate.mjs: a response with status: "incomplete" and incomplete_details.reason: "max_output_tokens" now gives the fixed error output_limit: "The answer was longer than 512 tokens, so it was cut off and not returned. It may still be billed. Ask for a shorter answer or split the request. The same text will likely fail again." None of the cut-off text is returned. Any other incomplete or unexpected response is still invalid_response.
• The tool description (companion/src/mcp.mjs) and docs/agent-companion.md (limits, agent contract, troubleshooting) now say a longer answer isn't returned.
• policy.json is unchanged, so the pinned policy hash still matches. No dependency changes.

Tests

• npm --prefix companion run check: 64 of 64 pass.
• The new unit test fails without the fix and passes with it.
• New cases:
  • a cut-off answer, with and without partial text;
  • content_filter, a missing reason and another model, which stay invalid_response;
  • the bridge exact-text allowlist;
  • an end-to-end check through the broker, the bridge and the agent client, which confirms a fake marker in the cut-off text never reaches the agent.
• No Rust or WebView code changed.

Review notes

• Two reviewers checked the change independently, and each finding was checked again. The 12 that held up are fixed. Most were about wording that went too far, for example "other accounts can't read your home folder".
• Not checked by hand: the macOS 14+ "access data from other apps" prompt, including that a yes lasts only until the app quits. That comes from Apple Developer Forums answers, not Apple's documentation. The guide says these steps are unchecked.

🤖 Generated with Claude Code