feat(board): render approval summary/recommendedAction/nextActionOnApproval as markdown

Replaces plain <p> tags in BoardApprovalPayloadContent with MarkdownBody (softBreaks enabled) so agent-authored markdown in these three fields — headers, bullets, and newlines — renders correctly in the Board UI instead of collapsing into a single unstyled paragraph. No schema change; the fields remain plain strings in the approval payload, only the renderer changed. Matches how comments, issue documents, and interaction cards already render markdown via MarkdownBody. Test coverage added for ## header → <h2>, bullet list → <ul><li>, and plain-prose regression (no markup injected for single-line inputs). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-01 08:20:14 -04:00
10 changed files with 156 additions and 602 deletions
@@ -473,7 +473,6 @@ export type {
  CompanyPortabilityImportRequest,
  CompanyPortabilityImportResult,
  CompanyPortabilityExportRequest,
-  CompanyPortabilitySecretEntry,
  EnvBinding,
  AgentEnvConfig,
  CompanySecret,
@@ -1,4 +1,4 @@
-import type { AgentEnvConfig, SecretProvider } from "./secrets.js";
+import type { AgentEnvConfig } from "./secrets.js";
 import type { RoutineVariable } from "./routine.js";

 export interface CompanyPortabilityInclude {
@@ -18,10 +18,6 @@ export interface CompanyPortabilityEnvInput {
  requirement: "required" | "optional";
  defaultValue: string | null;
  portability: "portable" | "system_dependent";
-  secretName?: string | null;
-  secretProvider?: string | null;
-  /** Binding type — stored in extension.inputs.env but not in the manifest type itself */
-  type?: "secret_ref" | "plain";
 }

 export type CompanyPortabilityFileEntry =
@@ -170,15 +166,6 @@ export interface CompanyPortabilityManifest {
  projects: CompanyPortabilityProjectManifestEntry[];
  issues: CompanyPortabilityIssueManifestEntry[];
  envInputs: CompanyPortabilityEnvInput[];
-  secrets?: CompanyPortabilitySecretEntry[];
-}
-
-export interface CompanyPortabilitySecretEntry {
-  name: string;
-  provider: SecretProvider;
-  description: string | null;
-  latestVersion: number;
-  currentValue: string;
 }

 export interface CompanyPortabilityExportResult {
@@ -330,5 +317,4 @@ export interface CompanyPortabilityExportRequest {
  selectedFiles?: string[];
  expandReferencedSkills?: boolean;
  sidebarOrder?: Partial<CompanyPortabilitySidebarOrder>;
-  includeSecrets?: boolean;
 }
@@ -304,7 +304,6 @@ export type {
  CompanyPortabilityImportRequest,
  CompanyPortabilityImportResult,
  CompanyPortabilityExportRequest,
-  CompanyPortabilitySecretEntry,
 } from "./company-portability.js";
 export type {
  JsonSchema,
@@ -21,9 +21,6 @@ export const portabilityEnvInputSchema = z.object({
  requirement: z.enum(["required", "optional"]),
  defaultValue: z.string().nullable(),
  portability: z.enum(["portable", "system_dependent"]),
-  secretName: z.string().min(1).nullable().optional(),
-  secretProvider: z.string().min(1).nullable().optional(),
-  type: z.enum(["secret_ref", "plain"]).optional(),
 });

 export const portabilityFileEntrySchema = z.union([
@@ -178,13 +175,6 @@ export const portabilityManifestSchema = z.object({
  projects: z.array(portabilityProjectManifestEntrySchema).default([]),
  issues: z.array(portabilityIssueManifestEntrySchema).default([]),
  envInputs: z.array(portabilityEnvInputSchema).default([]),
-  secrets: z.array(z.object({
-    name: z.string().min(1),
-    provider: z.string().min(1),
-    description: z.string().nullable(),
-    latestVersion: z.number().int().nonnegative(),
-    currentValue: z.string(),
-  })).optional(),
 });

 export const portabilitySourceSchema = z.discriminatedUnion("type", [
@@ -227,7 +217,6 @@ export const companyPortabilityExportSchema = z.object({
  selectedFiles: z.array(z.string().min(1)).optional(),
  expandReferencedSkills: z.boolean().optional(),
  sidebarOrder: portabilitySidebarOrderSchema.partial().optional(),
-  includeSecrets: z.boolean().optional(),
 });

 export type CompanyPortabilityExport = z.infer<typeof companyPortabilityExportSchema>;
@@ -14,7 +14,6 @@ const companySvc = {

 const agentSvc = {
  list: vi.fn(),
-  getById: vi.fn(),
  create: vi.fn(),
  update: vi.fn(),
 };
@@ -28,7 +27,6 @@ const accessSvc = {

 const projectSvc = {
  list: vi.fn(),
-  getById: vi.fn(),
  create: vi.fn(),
  update: vi.fn(),
  createWorkspace: vi.fn(),
@@ -64,26 +62,6 @@ const assetSvc = {
 const secretSvc = {
  normalizeAdapterConfigForPersistence: vi.fn(async (_companyId: string, config: Record<string, unknown>) => config),
  resolveAdapterConfigForRuntime: vi.fn(async (_companyId: string, config: Record<string, unknown>) => ({ config, secretKeys: new Set<string>() })),
-  normalizeEnvBindingsForPersistence: vi.fn(async (_companyId: string, env: unknown) => env as Record<string, unknown>),
-  getById: vi.fn(async (id: string) => {
-    if (id === "secret-1") return { id: "secret-1", name: "anthropic-api-key", provider: "local_encrypted" };
-    if (id === "secret-2") return { id: "secret-2", name: "gh-token", provider: "local_encrypted" };
-    return null;
-  }),
-  resolveSecretValue: vi.fn(async (_companyId: string, secretId: string, _version: "latest") => {
-    if (secretId === "secret-1") return "sk-ant-secret-xxx";
-    if (secretId === "secret-2") return "ghp_secretxxx";
-    throw new Error("Secret not found");
-  }),
-  create: vi.fn(async (companyId: string, input: { name: string; provider: string; value: string; description?: string | null }) => ({
-    id: `new-secret-${input.name}`,
-    companyId,
-    name: input.name,
-    provider: input.provider,
-    description: input.description ?? null,
-    latestVersion: 1,
-  })),
-  getByName: vi.fn(async (_companyId: string, name: string) => null),
 };

 const agentInstructionsSvc = {
@@ -470,6 +448,7 @@ describe("company portability", () => {
    expect(extension).not.toContain("instructionsFilePath");
    expect(extension).not.toContain("command:");
    expect(extension).not.toContain("secretId");
+    expect(extension).not.toContain('type: "secret_ref"');
    expect(extension).toContain("inputs:");
    expect(extension).toContain("ANTHROPIC_API_KEY:");
    expect(extension).toContain('requirement: "optional"');
@@ -1220,9 +1199,6 @@ describe("company portability", () => {
        requirement: "optional",
        defaultValue: "",
        portability: "portable",
-        secretName: "anthropic-api-key",
-        secretProvider: "local_encrypted",
-        type: "secret_ref",
      },
      {
        key: "GH_TOKEN",
@@ -1233,9 +1209,6 @@ describe("company portability", () => {
        requirement: "optional",
        defaultValue: "",
        portability: "portable",
-        secretName: "gh-token",
-        secretProvider: "local_encrypted",
-        type: "secret_ref",
      },
    ]);
  });
@@ -1359,9 +1332,6 @@ describe("company portability", () => {
      requirement: "optional",
      defaultValue: "",
      portability: "portable",
-      secretName: null,
-      secretProvider: null,
-      type: "plain",
    });
  });

@@ -2676,191 +2646,6 @@ describe("company portability", () => {
    }));
  });

-  describe("secret env vars", () => {
-    beforeEach(() => {
-      // Reset create/getByName to ensure clean state per test
-      secretSvc.create.mockReset();
-      secretSvc.getByName.mockReset();
-      secretSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "secret-1") return { id: "secret-1", name: "anthropic-api-key", provider: "local_encrypted" };
-        if (id === "secret-2") return { id: "secret-2", name: "gh-token", provider: "local_encrypted" };
-        return null;
-      });
-      secretSvc.resolveSecretValue.mockImplementation(async (_companyId: string, secretId: string) => {
-        if (secretId === "secret-1") return "sk-ant-secret-xxx";
-        if (secretId === "secret-2") return "ghp_secretxxx";
-        throw new Error("Secret not found");
-      });
-      secretSvc.create.mockImplementation(async (companyId: string, input: { name: string; provider: string; value: string; description?: string | null }) => ({
-        id: `new-secret-${input.name}`,
-        companyId,
-        name: input.name,
-        provider: input.provider,
-        description: input.description ?? null,
-        latestVersion: 1,
-      }));
-      secretSvc.getByName.mockResolvedValue(null);
-    });
-
-    it("exports secret env var metadata with secretName and secretProvider", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-      });
-      const secretInput = exported.manifest.envInputs.find(
-        (e: any) => e.key === "ANTHROPIC_API_KEY" && e.kind === "secret",
-      );
-      expect(secretInput).toBeDefined();
-      expect(secretInput.secretName).toBe("anthropic-api-key");
-      expect(secretInput.secretProvider).toBe("local_encrypted");
-    });
-
-    it("exports secret values to manifest when includeSecrets is true", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      expect(exported.manifest.secrets).toBeDefined();
-      expect(exported.manifest.secrets).toContainEqual(expect.objectContaining({
-        name: "anthropic-api-key",
-        provider: "local_encrypted",
-        currentValue: "sk-ant-secret-xxx",
-      }));
-    });
-
-    it("omits secrets section when includeSecrets is false", async () => {
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: false,
-      });
-      expect(exported.manifest.secrets).toBeUndefined();
-    });
-
-    it("writes placeholder when resolveSecretValue throws (cross-instance decryption failure)", async () => {
-      secretSvc.resolveSecretValue.mockImplementation(async () => {
-        throw new Error("Decryption failed: missing master key");
-      });
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      const secretEntry = exported.manifest.secrets?.find((s: any) => s.name === "anthropic-api-key");
-      expect(secretEntry?.currentValue).toBe("<decryption-key-missing:anthropic-api-key>");
-      expect(exported.warnings).toContainEqual(expect.stringContaining("could not be decrypted during export"));
-    });
-
-    it("imports secrets and remaps secret_ref bindings to new secret IDs", async () => {
-      const portability = companyPortabilityService({} as any);
-      agentSvc.create.mockImplementation(async (companyId: string, patch: Record<string, unknown>) => ({
-        id: "new-agent-1",
-        companyId,
-        ...patch,
-      }));
-      agentSvc.update.mockImplementation(async (id: string, patch: Record<string, unknown>) => patch as any);
-      agentSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "new-agent-1") {
-          return { id: "new-agent-1", adapterConfig: { env: { ANTHROPIC_API_KEY: { type: "secret_ref", secretId: "placeholder-secret" } } } };
-        }
-        return null;
-      });
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      const imported = await portability.importBundle({
-        source: { type: "inline", rootPath: exported.rootPath, files: exported.files },
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        target: { mode: "existing_company", companyId: "company-imported" },
-        agents: ["claudecoder"],
-        collisionStrategy: "rename",
-      }, "user-1");
-      expect(secretSvc.create).toHaveBeenCalled();
-      expect(agentSvc.update).toHaveBeenCalledWith(
-        "new-agent-1",
-        expect.any(Object),
-      );
-    });
-
-    it("reuses existing secret on conflict during import", async () => {
-      secretSvc.getByName.mockImplementation(async (_companyId: string, name: string) => {
-        if (name === "anthropic-api-key") return { id: "existing-secret-1", name, provider: "local_encrypted" };
-        return null;
-      });
-      const portability = companyPortabilityService({} as any);
-      agentSvc.create.mockImplementation(async (companyId: string, patch: Record<string, unknown>) => ({
-        id: "new-agent-1",
-        companyId,
-        ...patch,
-      }));
-      agentSvc.update.mockImplementation(async (id: string, patch: Record<string, unknown>) => patch as any);
-      agentSvc.getById.mockImplementation(async (id: string) => {
-        if (id === "new-agent-1") {
-          return { id: "new-agent-1", adapterConfig: { env: { ANTHROPIC_API_KEY: { type: "secret_ref", secretId: "placeholder-secret" } } } };
-        }
-        return null;
-      });
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["claudecoder"],
-        includeSecrets: true,
-      });
-      await portability.importBundle({
-        source: { type: "inline", rootPath: exported.rootPath, files: exported.files },
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        target: { mode: "existing_company", companyId: "company-imported" },
-        agents: ["claudecoder"],
-        collisionStrategy: "rename",
-      }, "user-1");
-      expect(agentSvc.update).toHaveBeenCalled();
-    });
-
-    it("exports plain env vars faithfully", async () => {
-      agentSvc.list.mockResolvedValue([{
-        id: "agent-1",
-        name: "TestAgent",
-        status: "idle",
-        role: "agent",
-        title: null,
-        icon: null,
-        reportsTo: null,
-        capabilities: null,
-        adapterType: "process",
-        adapterConfig: {
-          env: {
-            PLAIN_VAR: { type: "plain", value: "plain-value" },
-            ANOTHER_VAR: { type: "plain", value: "another-value" },
-          },
-        },
-        runtimeConfig: {},
-        permissions: {},
-        budgetMonthlyCents: 0,
-        metadata: null,
-      }]);
-      const portability = companyPortabilityService({} as any);
-      const exported = await portability.exportBundle("company-1", {
-        include: { agents: true, company: false, projects: false, issues: false, skills: false },
-        agents: ["testagent"],
-      });
-      const plainInputs = exported.manifest.envInputs.filter((e: any) => e.kind === "plain");
-      expect(plainInputs).toContainEqual(expect.objectContaining({
-        key: "PLAIN_VAR",
-        defaultValue: "plain-value",
-      }));
-      expect(plainInputs).toContainEqual(expect.objectContaining({
-        key: "ANOTHER_VAR",
-        defaultValue: "another-value",
-      }));
-    });
-  });
-
  it("nameOverrides applied after collision detection do not re-validate uniqueness", async () => {
    const portability = companyPortabilityService({} as any);

@@ -26,11 +26,9 @@ import type {
  CompanyPortabilityIssueManifestEntry,
  CompanyPortabilitySidebarOrder,
  CompanyPortabilitySkillManifestEntry,
-  CompanyPortabilitySecretEntry,
  CompanySkill,
  AgentEnvConfig,
  RoutineVariable,
-  SecretProvider,
 } from "@paperclipai/shared";
 import {
  AGENT_DEFAULT_MAX_CONCURRENT_RUNS,
@@ -52,7 +50,7 @@ import {
 } from "@paperclipai/adapter-utils/server-utils";
 import { ensureOpenCodeModelConfiguredAndAvailable } from "@paperclipai/adapter-opencode-local/server";
 import { findServerAdapter } from "../adapters/index.js";
-import { forbidden, HttpError, notFound, unprocessable } from "../errors.js";
+import { forbidden, notFound, unprocessable } from "../errors.js";
 import { ghFetch, gitHubApiBase, resolveRawGitHubUrl } from "./github-fetch.js";
 import type { StorageService } from "../storage/types.js";
 import { accessService } from "./access.js";
@@ -401,7 +399,7 @@ function normalizePortableProjectEnv(value: unknown): AgentEnvConfig | null {
  return parsed.success ? parsed.data : null;
 }

-async function extractPortableScopedEnvInputs(
+function extractPortableScopedEnvInputs(
  scope: {
    label: string;
    warningPrefix: string;
@@ -410,11 +408,7 @@ async function extractPortableScopedEnvInputs(
  },
  envValue: unknown,
  warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
  if (!isPlainRecord(envValue)) return [];
  const env = envValue as Record<string, unknown>;
  const inputs: CompanyPortabilityEnvInput[] = [];
@@ -426,7 +420,6 @@ async function extractPortableScopedEnvInputs(
    }

    if (isPlainRecord(binding) && binding.type === "secret_ref") {
-      const secret = await secrets.getById(String(binding.secretId));
      inputs.push({
        key,
        description: `Provide ${key} for ${scope.label}`,
@@ -436,33 +429,7 @@ async function extractPortableScopedEnvInputs(
        requirement: "optional",
        defaultValue: "",
        portability: "portable",
-        secretName: secret?.name ?? null,
-        secretProvider: secret?.provider ?? null,
      });
-      if (includeSecrets && secret && binding.secretId) {
-        const alreadyExported = secretEntries.some((e) => e.name === secret.name);
-        if (!alreadyExported) {
-          try {
-            const resolvedValue = await secrets.resolveSecretValue(companyId, String(binding.secretId), "latest");
-            secretEntries.push({
-              name: secret.name,
-              provider: secret.provider as SecretProvider,
-              description: secret.description,
-              latestVersion: secret.latestVersion,
-              currentValue: resolvedValue,
-            });
-          } catch {
-            secretEntries.push({
-              name: secret.name,
-              provider: secret.provider as SecretProvider,
-              description: secret.description,
-              latestVersion: secret.latestVersion,
-              currentValue: `<decryption-key-missing:${secret.name}>`,
-            });
-            warnings.push(`Secret "${secret.name}" could not be decrypted during export. Placeholder written.`);
-          }
-        }
-      }
      continue;
    }

@@ -472,6 +439,9 @@ async function extractPortableScopedEnvInputs(
      const portability = defaultValue && isAbsoluteCommand(defaultValue)
        ? "system_dependent"
        : "portable";
+      if (portability === "system_dependent") {
+        warnings.push(`${scope.warningPrefix} env ${key} default was exported as system-dependent.`);
+      }
      inputs.push({
        key,
        description: `Optional default for ${key} on ${scope.label}`,
@@ -487,6 +457,9 @@ async function extractPortableScopedEnvInputs(

    if (typeof binding === "string") {
      const portability = isAbsoluteCommand(binding) ? "system_dependent" : "portable";
+      if (portability === "system_dependent") {
+        warnings.push(`${scope.warningPrefix} env ${key} default was exported as system-dependent.`);
+      }
      inputs.push({
        key,
        description: `Optional default for ${key} on ${scope.label}`,
@@ -594,14 +567,11 @@ type AgentLike = {
 };

 type EnvInputRecord = {
-  type?: "secret_ref" | "plain";
  kind: "secret" | "plain";
  requirement: "required" | "optional";
  default?: string | null;
  description?: string | null;
  portability?: "portable" | "system_dependent";
-  secretName?: string | null;
-  secretProvider?: string | null;
 };

 const COMPANY_LOGO_CONTENT_TYPE_EXTENSIONS: Record<string, string> = {
@@ -1653,15 +1623,11 @@ function isAbsoluteCommand(value: string) {
  return path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value);
 }

-async function extractPortableEnvInputs(
+function extractPortableEnvInputs(
  agentSlug: string,
  envValue: unknown,
  warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
  return extractPortableScopedEnvInputs(
    {
      label: `agent ${agentSlug}`,
@@ -1671,22 +1637,14 @@ async function extractPortableEnvInputs(
    },
    envValue,
    warnings,
-    secrets,
-    secretEntries,
-    includeSecrets,
-    companyId,
  );
 }

-async function extractPortableProjectEnvInputs(
+function extractPortableProjectEnvInputs(
  projectSlug: string,
  envValue: unknown,
  warnings: string[],
-  secrets: { getById: (id: string) => Promise<{ name: string; provider: string; description: string | null; latestVersion: number } | null>; resolveSecretValue: (companyId: string, secretId: string, version: "latest") => Promise<string> },
-  secretEntries: CompanyPortabilitySecretEntry[],
-  includeSecrets: boolean,
-  companyId: string,
-): Promise<CompanyPortabilityEnvInput[]> {
+): CompanyPortabilityEnvInput[] {
  return extractPortableScopedEnvInputs(
    {
      label: `project ${projectSlug}`,
@@ -1696,10 +1654,6 @@ async function extractPortableProjectEnvInputs(
    },
    envValue,
    warnings,
-    secrets,
-    secretEntries,
-    includeSecrets,
-    companyId,
  );
 }

@@ -2304,13 +2258,6 @@ function buildEnvInputMap(inputs: CompanyPortabilityEnvInput[]) {
    if (input.defaultValue !== null) entry.default = input.defaultValue;
    if (input.description) entry.description = input.description;
    if (input.portability === "system_dependent") entry.portability = "system_dependent";
-    if (input.secretName) {
-      entry.secretName = input.secretName;
-      entry.type = "secret_ref";
-    } else {
-      entry.type = "plain";
-    }
-    if (input.secretProvider) entry.secretProvider = input.secretProvider;
    env[input.key] = entry;
  }
  return env;
@@ -2355,9 +2302,6 @@ function readAgentEnvInputs(
      requirement: record.requirement === "required" ? "required" : "optional",
      defaultValue: typeof record.default === "string" ? record.default : null,
      portability: record.portability === "system_dependent" ? "system_dependent" : "portable",
-      secretName: record.secretName ?? null,
-      secretProvider: record.secretProvider ?? null,
-      type: record.type,
    }];
  });
 }
@@ -2382,9 +2326,6 @@ function readProjectEnvInputs(
      requirement: record.requirement === "required" ? "required" : "optional",
      defaultValue: typeof record.default === "string" ? record.default : null,
      portability: record.portability === "system_dependent" ? "system_dependent" : "portable",
-      secretName: record.secretName ?? null,
-      secretProvider: record.secretProvider ?? null,
-      type: record.type,
    }];
  });
 }
@@ -2431,7 +2372,6 @@ function buildManifestFromPackageFiles(
  const paperclipProjects = isPlainRecord(paperclipExtension.projects) ? paperclipExtension.projects : {};
  const paperclipTasks = isPlainRecord(paperclipExtension.tasks) ? paperclipExtension.tasks : {};
  const paperclipRoutines = isPlainRecord(paperclipExtension.routines) ? paperclipExtension.routines : {};
-  const paperclipSecrets = Array.isArray(paperclipExtension.secrets) ? paperclipExtension.secrets : [];
  const companyName =
    asString(companyFrontmatter.name)
    ?? opts?.sourceLabel?.companyName
@@ -2515,7 +2455,6 @@ function buildManifestFromPackageFiles(
    projects: [],
    issues: [],
    envInputs: [],
-    secrets: paperclipSecrets.length > 0 ? paperclipSecrets : undefined,
  };

  const warnings: string[] = [];
@@ -3030,9 +2969,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
    const files: Record<string, CompanyPortabilityFileEntry> = {};
    const warnings: string[] = [];
    const envInputs: CompanyPortabilityManifest["envInputs"] = [];
-    const secretEntries: CompanyPortabilitySecretEntry[] = [];
    const requestedSidebarOrder = normalizePortableSidebarOrder(input.sidebarOrder);
-    const includeSecrets = input.includeSecrets === true;
    const rootPath = normalizeAgentUrlKey(company.name) ?? "company-package";
    let companyLogoPath: string | null = null;

@@ -3312,14 +3249,10 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
        warnings.push(...exportedInstructions.warnings);

        const envInputsStart = envInputs.length;
-        const exportedEnvInputs = await extractPortableEnvInputs(
+        const exportedEnvInputs = extractPortableEnvInputs(
          slug,
          (agent.adapterConfig as Record<string, unknown>).env,
          warnings,
-          secrets,
-          secretEntries,
-          includeSecrets,
-          companyId,
        );
        envInputs.push(...exportedEnvInputs);
        const adapterDefaultRules = ADAPTER_DEFAULT_RULES_BY_TYPE[agent.adapterType] ?? [];
@@ -3396,7 +3329,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
      const slug = projectSlugById.get(project.id)!;
      const projectPath = `projects/${slug}/PROJECT.md`;
      const envInputsStart = envInputs.length;
-      const exportedEnvInputs = await extractPortableProjectEnvInputs(slug, project.env, warnings, secrets, secretEntries, includeSecrets, companyId);
+      const exportedEnvInputs = extractPortableProjectEnvInputs(slug, project.env, warnings);
      envInputs.push(...exportedEnvInputs);
      const projectEnvInputs = dedupeEnvInputs(
        envInputs
@@ -3601,20 +3534,8 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
      skills: resolved.manifest.skills.length > 0,
    };
    resolved.manifest.envInputs = dedupeEnvInputs(envInputs);
-    if (includeSecrets) {
-      resolved.manifest.secrets = secretEntries.length > 0 ? secretEntries : undefined;
-    }
    resolved.warnings.unshift(...warnings);

-    // Rebuild the YAML file to include secrets so files stay in sync with manifest
-    // Only include secrets - other fields should come from the original YAML structure
-    if (includeSecrets && resolved.manifest.secrets) {
-      // Parse existing YAML and add secrets to it
-      const existingYaml = parseYamlFile(readPortableTextFile(finalFiles, paperclipExtensionPath) ?? "") ?? {};
-      existingYaml.secrets = resolved.manifest.secrets;
-      finalFiles[paperclipExtensionPath] = buildYamlFile(existingYaml, { preserveEmptyStrings: true });
-    }
-
    return {
      rootPath,
      manifest: resolved.manifest,
@@ -4172,7 +4093,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
    const resultAgents: CompanyPortabilityImportResult["agents"] = [];
    const resultProjects: CompanyPortabilityImportResult["projects"] = [];
    const importedSlugToAgentId = new Map<string, string>();
-    const secretNameToId = new Map<string, string>();
    const existingSlugToAgentId = new Map<string, string>();
    const agentStatusById = new Map<string, string | null | undefined>();
    const existingAgents = await agents.list(targetCompany.id);
@@ -4204,35 +4124,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
      }
    }

-    // Create secrets in target company and build name->id map
-    for (const secretEntry of sourceManifest.secrets ?? []) {
-      if (secretEntry.currentValue.startsWith("<decryption-key-missing:")) {
-        warnings.push(`Secret "${secretEntry.name}" could not be decrypted in source instance. ` +
-          `Placeholder written for key. Create a secret with this name and update manually.`);
-        continue;
-      }
-      try {
-        const created = await secrets.create(targetCompany.id, {
-          name: secretEntry.name,
-          provider: secretEntry.provider,
-          value: secretEntry.currentValue,
-          description: secretEntry.description,
-        });
-        secretNameToId.set(secretEntry.name, created.id);
-      } catch (err) {
-        if (err instanceof HttpError && err.status === 409) {
-          const existing = await secrets.getByName(targetCompany.id, secretEntry.name);
-          if (existing) {
-            secretNameToId.set(secretEntry.name, existing.id);
-          } else {
-            warnings.push(`Secret "${secretEntry.name}" already exists but could not be resolved by name. Re-add env bindings for this secret manually.`);
-          }
-        } else {
-          warnings.push(`Failed to create secret "${secretEntry.name}": ${err instanceof Error ? err.message : String(err)}`);
-        }
-      }
-    }
-
    if (include.agents) {
      for (const planAgent of plan.preview.plan.agentPlans) {
        const manifestAgent = plan.selectedAgents.find((agent) => agent.slug === planAgent.slug);
@@ -4289,30 +4180,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
          desiredSkills,
          mode,
        );
-
-        // Reconstruct adapterConfig.env from manifest.envInputs for this agent
-        const agentEnvInputs = (sourceManifest.envInputs ?? []).filter((e) => e.agentSlug === manifestAgent.slug);
-        if (agentEnvInputs.length > 0) {
-          const env: Record<string, unknown> = {};
-          for (const ei of agentEnvInputs) {
-            if (ei.kind === "secret" && ei.secretName) {
-              const newSecretId = secretNameToId.get(ei.secretName);
-              if (newSecretId) {
-                env[ei.key] = { type: "secret_ref", secretId: newSecretId };
-              } else {
-                warnings.push(`Env key "${ei.key}" for agent ${manifestAgent.slug} references secret "${ei.secretName}" which was not included in this package. Re-add manually.`);
-              }
-            } else if (ei.kind === "secret" && !ei.secretName) {
-              warnings.push(`Env key "${ei.key}" for agent ${manifestAgent.slug} could not be reconstructed (sensitive binding without secret reference). Re-add manually.`);
-            } else if (ei.kind === "plain" && ei.defaultValue !== null) {
-              env[ei.key] = { type: "plain", value: ei.defaultValue };
-            }
-          }
-          if (Object.keys(env).length > 0) {
-            normalizedAdapter.adapterConfig.env = await secrets.normalizeEnvBindingsForPersistence(targetCompany.id, env as any, { strictMode: strictSecretsMode });
-          }
-        }
-
        const patch = {
          name: planAgent.plannedName,
          role: manifestAgent.role,
@@ -4363,9 +4230,10 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
          continue;
        }

+        const createdStatus = "idle";
        let created = await agents.create(targetCompany.id, {
          ...patch,
-          status: "idle",
+          status: createdStatus,
        });
        await access.ensureMembership(targetCompany.id, "agent", created.id, "member", "active");
        await access.setPrincipalPermission(
@@ -4385,7 +4253,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
        } catch (err) {
          warnings.push(`Failed to materialize instructions bundle for ${manifestAgent.slug}: ${err instanceof Error ? err.message : String(err)}`);
        }
-        agentStatusById.set(created.id, created.status ?? "idle");
+        agentStatusById.set(created.id, created.status ?? createdStatus);
        importedSlugToAgentId.set(planAgent.slug, created.id);
        existingSlugToAgentId.set(normalizeAgentUrlKey(created.name) ?? created.id, created.id);
        resultAgents.push({
@@ -4434,26 +4302,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
            ?? null
          : null;
        const projectWorkspaceIdByKey = new Map<string, string>();
-        // Build project env from manifest.envInputs filtered by this project
-        const projectEnvInputs = (sourceManifest.envInputs ?? []).filter((e) => e.projectSlug === planProject.slug);
-        const reconstructedProjectEnv: Record<string, unknown> = {};
-        for (const ei of projectEnvInputs) {
-          if (ei.kind === "secret" && ei.secretName) {
-            const newSecretId = secretNameToId.get(ei.secretName);
-            if (newSecretId) {
-              reconstructedProjectEnv[ei.key] = { type: "secret_ref", secretId: newSecretId };
-            } else {
-              warnings.push(`Env key "${ei.key}" for project ${planProject.slug} references secret "${ei.secretName}" which was not included in this package. Re-add manually.`);
-            }
-          } else if (ei.kind === "secret" && !ei.secretName) {
-            warnings.push(`Env key "${ei.key}" for project ${planProject.slug} could not be reconstructed (sensitive binding without secret reference). Re-add manually.`);
-          } else if (ei.kind === "plain" && ei.defaultValue !== null) {
-            reconstructedProjectEnv[ei.key] = { type: "plain", value: ei.defaultValue };
-          }
-        }
-        const projectEnvConfig = Object.keys(reconstructedProjectEnv).length > 0
-          ? await secrets.normalizeEnvBindingsForPersistence(targetCompany.id, reconstructedProjectEnv as any, { strictMode: strictSecretsMode })
-          : null;
        const projectPatch = {
          name: planProject.plannedName,
          description: manifestProject.description,
@@ -4463,7 +4311,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
          status: manifestProject.status && PROJECT_STATUSES.includes(manifestProject.status as any)
            ? manifestProject.status as typeof PROJECT_STATUSES[number]
            : "backlog",
-          env: projectEnvConfig ?? undefined,
+          env: manifestProject.env,
          executionWorkspacePolicy: stripPortableProjectExecutionWorkspaceRefs(manifestProject.executionWorkspacePolicy),
        };

@@ -4542,91 +4390,6 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
      }
    }

-    // Remap secret_ref bindings in imported agent/project records to target company secret IDs
-    for (const envInput of sourceManifest.envInputs ?? []) {
-      if (envInput.kind !== "secret" || !envInput.secretName) continue;
-      const newSecretId = secretNameToId.get(envInput.secretName);
-      if (!newSecretId) {
-        // secret wasn't created (decryption failure or error) — it's already a placeholder in the env
-        continue;
-      }
-      if (envInput.agentSlug) {
-        const agentId = importedSlugToAgentId.get(envInput.agentSlug);
-        if (agentId) {
-          const agent = await agents.getById(agentId);
-          if (agent) {
-            const adapterConfig = agent.adapterConfig as Record<string, unknown>;
-            const env = adapterConfig.env as Record<string, unknown> | undefined;
-            let mutated = false;
-            if (env && typeof env[envInput.key] === "object" && env[envInput.key] !== null) {
-              const binding = env[envInput.key] as Record<string, unknown>;
-              if (binding.type === "secret_ref" && binding.secretId !== newSecretId) {
-                binding.secretId = newSecretId;
-                mutated = true;
-              }
-            }
-            if (mutated) await agents.update(agentId, { adapterConfig });
-          }
-        }
-      } else if (envInput.projectSlug) {
-        const projectId = importedSlugToProjectId.get(envInput.projectSlug);
-        if (projectId) {
-          const project = await projects.getById(projectId);
-          if (project && project.env && typeof project.env === "object") {
-            const env = project.env as Record<string, unknown>;
-            let mutated = false;
-            if (typeof env[envInput.key] === "object" && env[envInput.key] !== null) {
-              const binding = env[envInput.key] as Record<string, unknown>;
-              if (binding.type === "secret_ref" && binding.secretId !== newSecretId) {
-                binding.secretId = newSecretId;
-                mutated = true;
-              }
-            }
-            if (mutated) await projects.update(projectId, { env: env as import("@paperclipai/shared").AgentEnvConfig });
-          }
-        }
-      }
-    }
-
-    // Note: the legacy secret remapping below is kept as a safety net for
-    // agents/projects that were created/updated before this code existed.
-    // It can be removed once the inline reconstruction above is stable.
-    // Reconstruct plain env bindings and fill in missing env keys on imported agents/projects
-    for (const envInput of sourceManifest.envInputs ?? []) {
-      if (envInput.kind !== "plain" && !(envInput.kind === "secret" && !envInput.secretName)) continue;
-      if (!envInput.defaultValue && envInput.kind === "plain") continue;
-
-      if (envInput.agentSlug) {
-        const agentId = importedSlugToAgentId.get(envInput.agentSlug);
-        if (!agentId) continue;
-        const agent = await agents.getById(agentId);
-        if (!agent) continue;
-        const adapterConfig = agent.adapterConfig as Record<string, unknown>;
-        const env = (adapterConfig.env as Record<string, unknown>) ?? {};
-        let mutated = false;
-        if (!env[envInput.key] && envInput.kind === "plain") {
-          env[envInput.key] = { type: "plain", value: envInput.defaultValue ?? "" };
-          mutated = true;
-        }
-        if (mutated) {
-          adapterConfig.env = env;
-          await agents.update(agentId, { adapterConfig });
-        }
-      } else if (envInput.projectSlug) {
-        const projectId = importedSlugToProjectId.get(envInput.projectSlug);
-        if (!projectId) continue;
-        const project = await projects.getById(projectId);
-        if (!project) continue;
-        const env = (project.env as Record<string, unknown>) ?? {};
-        let mutated = false;
-        if (!env[envInput.key] && envInput.kind === "plain") {
-          env[envInput.key] = { type: "plain", value: envInput.defaultValue ?? "" };
-          mutated = true;
-        }
-        if (mutated) await projects.update(projectId, { env: env as import("@paperclipai/shared").AgentEnvConfig });
-      }
-    }
-
    if (include.issues) {
      const routines = routineService(db);
      for (const manifestIssue of sourceManifest.issues) {
@@ -1,13 +1,33 @@
 // @vitest-environment jsdom

 import { act } from "react";
+import type { ReactNode } from "react";
 import { createRoot } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { renderToStaticMarkup } from "react-dom/server";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ThemeProvider } from "../context/ThemeContext";
 import { ApprovalPayloadRenderer, approvalLabel } from "./ApprovalPayload";

+vi.mock("@/lib/router", () => ({
+  Link: ({ children, to }: { children: ReactNode; to: string }) => <a href={to}>{children}</a>,
+}));
+
+vi.mock("../api/issues", () => ({
+  issuesApi: { get: vi.fn() },
+}));
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 (globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;

+function withProviders(children: ReactNode) {
+  return (
+    <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
+      <ThemeProvider>{children}</ThemeProvider>
+    </QueryClientProvider>
+  );
+}
+
 describe("approvalLabel", () => {
  it("uses payload titles for generic board approvals", () => {
    expect(
@@ -35,17 +55,19 @@ describe("ApprovalPayloadRenderer", () => {

    act(() => {
      root.render(
-        <ApprovalPayloadRenderer
-          type="request_board_approval"
-          payload={{
-            title: "Reply with an ASCII frog",
-            summary: "Board asked for approval before posting the frog.",
-            recommendedAction: "Approve the frog reply.",
-            nextActionOnApproval: "Post the frog comment on the issue.",
-            risks: ["The frog might be too powerful."],
-            proposedComment: "(o)<",
-          }}
-        />,
+        withProviders(
+          <ApprovalPayloadRenderer
+            type="request_board_approval"
+            payload={{
+              title: "Reply with an ASCII frog",
+              summary: "Board asked for approval before posting the frog.",
+              recommendedAction: "Approve the frog reply.",
+              nextActionOnApproval: "Post the frog comment on the issue.",
+              risks: ["The frog might be too powerful."],
+              proposedComment: "(o)<",
+            }}
+          />,
+        ),
      );
    });

@@ -67,14 +89,16 @@ describe("ApprovalPayloadRenderer", () => {

    act(() => {
      root.render(
-        <ApprovalPayloadRenderer
-          type="request_board_approval"
-          hidePrimaryTitle
-          payload={{
-            title: "Reply with an ASCII frog",
-            summary: "Board asked for approval before posting the frog.",
-          }}
-        />,
+        withProviders(
+          <ApprovalPayloadRenderer
+            type="request_board_approval"
+            hidePrimaryTitle
+            payload={{
+              title: "Reply with an ASCII frog",
+              summary: "Board asked for approval before posting the frog.",
+            }}
+          />,
+        ),
      );
    });

@@ -86,3 +110,90 @@ describe("ApprovalPayloadRenderer", () => {
    });
  });
 });
+
+describe("BoardApprovalPayloadContent markdown rendering", () => {
+  it("renders a ## header in summary as an h2 element", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ summary: "## Analysis\n\nThis is the summary." }}
+        />,
+      ),
+    );
+    expect(html).toContain("<h2");
+    expect(html).toContain("Analysis");
+    expect(html).toContain("This is the summary.");
+  });
+
+  it("renders a bulleted list in summary as ul and li elements", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ summary: "- Item one\n- Item two" }}
+        />,
+      ),
+    );
+    expect(html).toContain("<ul");
+    expect(html).toContain("<li");
+    expect(html).toContain("Item one");
+    expect(html).toContain("Item two");
+  });
+
+  it("renders a ## header in recommendedAction as an h2 element", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ recommendedAction: "## Approve\n\nApprove this action." }}
+        />,
+      ),
+    );
+    expect(html).toContain("<h2");
+    expect(html).toContain("Approve");
+    expect(html).toContain("Approve this action.");
+  });
+
+  it("renders a bulleted list in recommendedAction as ul and li elements", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ recommendedAction: "- Step one\n- Step two" }}
+        />,
+      ),
+    );
+    expect(html).toContain("<ul");
+    expect(html).toContain("<li");
+    expect(html).toContain("Step one");
+  });
+
+  it("renders plain prose summary without adding list or heading markup", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ summary: "This is a simple one-line summary." }}
+        />,
+      ),
+    );
+    expect(html).toContain("This is a simple one-line summary.");
+    expect(html).not.toContain("<ul");
+    expect(html).not.toContain("<h2");
+  });
+
+  it("renders plain prose recommendedAction without markdown markup", () => {
+    const html = renderToStaticMarkup(
+      withProviders(
+        <ApprovalPayloadRenderer
+          type="request_board_approval"
+          payload={{ recommendedAction: "Approve the deployment." }}
+        />,
+      ),
+    );
+    expect(html).toContain("Approve the deployment.");
+    expect(html).not.toContain("<ul");
+    expect(html).not.toContain("<h2");
+  });
+});
@@ -1,5 +1,6 @@
 import { UserPlus, Lightbulb, ShieldAlert, ShieldCheck } from "lucide-react";
 import { formatCents } from "../lib/utils";
+import { MarkdownBody } from "./MarkdownBody";

 export const typeLabel: Record<string, string> = {
  hire_agent: "Hire Agent",
@@ -185,7 +186,7 @@ function BoardApprovalPayloadContent({ payload }: { payload: Record<string, unkn
      {summary && (
        <div className="space-y-1">
          <p className="text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground">Summary</p>
-          <p className="leading-6 text-foreground/90">{summary}</p>
+          <MarkdownBody softBreaks>{summary}</MarkdownBody>
        </div>
      )}
      {recommendedAction && (
@@ -193,13 +194,13 @@ function BoardApprovalPayloadContent({ payload }: { payload: Record<string, unkn
          <p className="text-[11px] font-medium uppercase tracking-[0.08em] text-amber-700 dark:text-amber-300">
            Recommended action
          </p>
-          <p className="mt-1 leading-6 text-foreground">{recommendedAction}</p>
+          <MarkdownBody softBreaks className="mt-1">{recommendedAction}</MarkdownBody>
        </div>
      )}
      {nextActionOnApproval && (
        <div className="rounded-lg border border-border/60 bg-background/60 px-3.5 py-3">
          <p className="text-[11px] font-medium uppercase tracking-[0.08em] text-muted-foreground">On approval</p>
-          <p className="mt-1 leading-6 text-foreground">{nextActionOnApproval}</p>
+          <MarkdownBody softBreaks className="mt-1">{nextActionOnApproval}</MarkdownBody>
        </div>
      )}
      {risks.length > 0 && (
@@ -17,15 +17,6 @@ import { authApi } from "../api/auth";
 import { companiesApi } from "../api/companies";
 import { projectsApi } from "../api/projects";
 import { Button } from "@/components/ui/button";
-import { ToggleSwitch } from "@/components/ui/toggle-switch";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog";
 import { EmptyState } from "../components/EmptyState";
 import { PageSkeleton } from "../components/PageSkeleton";
 import { MarkdownBody } from "../components/MarkdownBody";
@@ -612,8 +603,6 @@ export function CompanyExport() {
  const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set());
  const [checkedFiles, setCheckedFiles] = useState<Set<string>>(new Set());
  const [treeSearch, setTreeSearch] = useState("");
-  const [includeSecrets, setIncludeSecrets] = useState(false);
-  const [secretsConfirmOpen, setSecretsConfirmOpen] = useState(false);
  const [taskLimit, setTaskLimit] = useState(TASKS_PAGE_SIZE);
  const savedExpandedRef = useRef<Set<string> | null>(null);
  const initialFileFromUrl = useRef(filePathFromLocation(location.pathname));
@@ -742,7 +731,6 @@ export function CompanyExport() {
        include: { company: true, agents: true, projects: true, issues: true },
        selectedFiles: Array.from(checkedFiles).sort(),
        sidebarOrder,
-        includeSecrets,
      }),
    onSuccess: (result) => {
      const resultCheckedFiles = new Set(Object.keys(result.files));
@@ -957,11 +945,6 @@ export function CompanyExport() {
                {warnings.length} warning{warnings.length === 1 ? "" : "s"}
              </span>
            )}
-            {includeSecrets && (
-              <span className="rounded-md border border-amber-500/30 bg-amber-500/5 px-2 py-0.5 text-xs text-amber-500">
-                Secrets included
-              </span>
-            )}
          </div>
          <Button
            size="sm"
@@ -991,29 +974,6 @@ export function CompanyExport() {
          <div className="border-b border-border px-4 py-3 shrink-0">
            <h2 className="text-base font-semibold">Package files</h2>
          </div>
-          <div className="border-b border-border px-4 py-2.5 shrink-0">
-            <div className="flex items-center gap-2 text-sm">
-              <ToggleSwitch
-                checked={includeSecrets}
-                onCheckedChange={(checked) => {
-                  if (checked) {
-                    setSecretsConfirmOpen(true);
-                  } else {
-                    setIncludeSecrets(false);
-                  }
-                }}
-              />
-              <span className="cursor-pointer text-muted-foreground hover:text-foreground transition-colors" onClick={() => {
-                if (includeSecrets) {
-                  setIncludeSecrets(false);
-                } else {
-                  setSecretsConfirmOpen(true);
-                }
-              }}>
-                Include secrets
-              </span>
-            </div>
-          </div>
          <div className="border-b border-border px-3 py-2 shrink-0">
            <div className="flex items-center gap-2 rounded-md border border-border px-2 py-1">
              <Search className="h-3.5 w-3.5 text-muted-foreground shrink-0" />
@@ -1054,26 +1014,6 @@ export function CompanyExport() {
          <ExportPreviewPane selectedFile={selectedFile} content={previewContent} allFiles={effectiveFiles} onSkillClick={handleSkillClick} />
        </div>
      </div>
-
-      {/* Secrets confirmation dialog */}
-      <Dialog open={secretsConfirmOpen} onOpenChange={setSecretsConfirmOpen}>
-        <DialogContent className="sm:max-w-md">
-          <DialogHeader>
-            <DialogTitle>Include secrets?</DialogTitle>
-            <DialogDescription>
-              Secrets will be exported as plaintext in the package file. Handle the exported package with care.
-            </DialogDescription>
-          </DialogHeader>
-          <DialogFooter>
-            <Button variant="ghost" onClick={() => setSecretsConfirmOpen(false)}>
-              Cancel
-            </Button>
-            <Button variant="destructive" onClick={() => { setIncludeSecrets(true); setSecretsConfirmOpen(false); }}>
-              Include secrets
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
    </div>
  );
 }
@@ -866,13 +866,6 @@ export function CompanyImport() {
        title: "Import complete",
        body: `${result.company.name}: ${result.agents.length} agent${result.agents.length === 1 ? "" : "s"} processed.`,
      });
-      if (result.warnings.some((w) => w.includes("could not be decrypted") || w.toLowerCase().includes("failed to create secret"))) {
-        pushToast({
-          tone: "warn",
-          title: "Secrets import warning",
-          body: "Some secrets could not be decrypted. Review warnings and recreate manually.",
-        });
-      }
      // Force a fresh dashboard load so newly imported agents are immediately visible.
      window.location.assign(`/${importedCompany.issuePrefix}/dashboard`);
    },
@@ -1316,18 +1309,6 @@ export function CompanyImport() {
            </div>
          )}

-          {/* Secrets info */}
-          {importPreview.manifest.secrets && importPreview.manifest.secrets.length > 0 && (
-            <div className="mx-5 mt-3 rounded-md border border-amber-500/30 bg-amber-500/5 px-4 py-3">
-              <div className="text-xs font-medium text-amber-500 mb-1">Secrets to import</div>
-              {importPreview.manifest.secrets.map((s) => (
-                <div key={s.name} className="text-xs text-amber-500">
-                  {s.name}{s.provider !== "local_encrypted" ? ` (${s.provider})` : ""}
-                </div>
-              ))}
-            </div>
-          )}
-
          {/* Errors */}
          {importPreview.errors.length > 0 && (
            <div className="mx-5 mt-3 rounded-md border border-destructive/30 bg-destructive/5 px-4 py-3">