at-zentao

# ZenTao Bug/Task Workflow ## Configuration Primary config lives under a `zentao` key in `~/.agent-tools/config.jsonc` — or `$AGENT_TOOLS_HOME/config.jsonc` when `AGENT_TOOLS_HOME` is set, matching the rest of agent-tools. Every `~/.agent-tools/config.jsonc` below means this resolved path: ```jsonc { "zentao": { "url": "http://zentao.example.com", "account": "...", "password": "..." } } ``` Resolution order (first match wins): - URL: env `ZENTAO_URL` → `zentao.url` in `~/.agent-tools/config.jsonc`. - Credentials: env `ZENTAO_ACCOUNT`/`ZENTAO_PASSWORD` → `zentao.account`/`zentao.password` in `~/.agent-tools/config.jsonc`. ZenTao config comes ONLY from env vars and the global `~/.agent-tools/config.jsonc`, never a repository-level file — so an untrusted repo can't redirect the endpoint to capture your credentials. **First-run setup** (when config is missing or incomplete): 1. If `~/.agent-tools/config.jsonc` has no `zentao` block, insert one INTO the root object (not appended after the closing `}`) — it is JSONC, so preserve existing keys and comments, and mind the trailing comma: `"zentao": { "url": "", "account": "", "password": "" }` 2. Ask for the URL and account as a PLAIN chat question and wait for the reply — never collect free-form values via a multiple-choice prompt (its fixed option labels would be submitted as the answer). Write the reply into the config — these are not secrets. 3. NEVER ask the user to paste the password into the chat (it ...