Tighten agent harness and secret handling

[jeancarlosmosq-lab]

Summary

• Refresh CLAUDE.md / add AGENTS.md (and slim .cursorrules) so agents get a cold-start harness: goals, non-negotiables, bus-factor setup, “working” checks, and session-memory rules.
• Ignore OAuth artifacts (credentials.json, token.pickle, *.pickle) at the repo root and in calendar.
• Mark MQTT/API secret config fields with x-secret and bump affected plugin versions + plugins.json (calendar, ledmatrix-weather, on-air, pomodoro-timer, mqtt-notifications, birdnet-go).

Test plan

• Confirm CI version-bump + schema gates pass for the six touched plugins
• Spot-check web UI: MQTT password fields and weather’s deprecated api_key are masked
• Confirm credentials.json / token.pickle under plugins/calendar/ are ignored by git
• Skim AGENTS.md / CLAUDE.md for accuracy against docs/plugin-development/

Made with Cursor

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 93429f89-8a4c-4684-887c-067f1078e72e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[ChuckBuilds]

Reviewing the open queue: this one is superseded and unmergeable — it should be closed.

#294's own description says so: "Rebases #288 onto main (it was conflicted) and fixes three things. Supersedes #288 — merging this lands that work too."

On top of that, this PR's head branch no longer exists on the remote:

chore/harness-audit-and-secrets   MISSING on origin
fix/agent-harness-followups       exists   (#294)

The commits are still reachable via refs/pull/288/head (4f1dcfa) if anything here turns out not to have made it into #294, so closing loses nothing.

Note that #294 is itself CONFLICTING now — it was opened on 19 Aug and main has moved since. It needs a rebase before it can land.

[ChuckBuilds]

Superseded by #294.

Both commits on this branch — d6b29a4 and 4f1dcfa — are now in #294, which I rebased onto main today; that PR is MERGEABLE/CLEAN. This branch was also deleted, so this PR is detached and cannot be updated in place.

Verified by recovering refs/pull/288/head and diffing: the two commits here are exactly the two that #294 now carries, with authorship preserved. Please close this one in favour of #294.

[ChuckBuilds]

Closing to address in #294.