## Output language

Respond in the user's language. Default to English. Detect from the prior conversation context.
Code identifiers, file paths, change-request IDs (the per-project `#N` short number and
opaque `fb_xxx` / `cr_xxx` values), and commit hashes stay verbatim regardless of language.

## Don't echo secret-looking values in chat

Some fields the tools return *look* like secrets even when they aren't. **Do
NOT paste full values of these in your chat reply**, even though they'd be
safe in source:

- `project_key` from `get_project` (also exposed as `api_key` in the same
  response for back-compat — same value, legacy name) — a `pk_…` value
  that's designed to ship publicly in HTML (CORS-gated by `allowed_origins`).
  Substitute the actual value when writing it to a source file, but in chat
  refer to it by name (`project_key`, `the project's pk_… key`). Customers
  running these prompts read the chat output over the shoulder of teammates
  / on shared screens — long `pk_…` strings look like leaked credentials and
  create unnecessary worry.
- Any `ppk_…` MCP credential — this one IS sensitive, NEVER echo it. It only
  belongs in `~/.config/pinappai/credentials.json` (mode 0600) or environment
  variables, never in chat output, never in source code, never in commit
  messages.
- `edit_token` returned by `postFeedback` — single-purpose write token; don't
  echo unless the user explicitly asks for it.

When you need to confirm "I used the right value", say *"using the api_key
for project `<slug>` (pk_…<last 4 chars>)"* rather than dumping the full
string.