diff --git a/SECURITY.md b/SECURITY.md
index a100d93b..bcbbd1d5 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -36,7 +36,10 @@ We aim to acknowledge reports within 72 hours and to ship a fix for critical iss
   turning on "remember this device" need a short-lived grant confirmed with your vault passphrase — a stolen API token
   alone is not enough.
 - **No privilege escalation through agents**: agents that create or edit agents cannot grant reveal access, change
-  workspaces, browser profiles or out-of-scope integrations; fill-only agents cannot delegate to reveal-mode agents.
+  workspaces, browser profiles or out-of-scope integrations. A task an agent hands to a reveal-mode agent runs
+  without raw secrets unless the caller reads raw secrets itself and the target is global or in the caller's workspace
+  (logins are still filled into pages), and that chat stays fill-only; scheduling such an agent, putting tasks on the
+  board for it or changing its settings stays with you. The task can still write to that agent's memory and files.
 - **Redaction**: known secret values (logins, 2FA, API keys, MCP env/header values) are masked in transcripts, run logs
   and the UI.
 - **Audit log**: every secret access (fill, reveal, export) is recorded with agent and run id.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 3acedb2d..a1ef24d6 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -157,7 +157,13 @@ ask within the same moment share a request.
   credentials; see [Godmode Cloud](#godmode-cloud).
 * **MCP gateway**: each run gets a random bearer token scoped to that run/agent; expires when the run ends.
   Management tools cannot grant reveal access, move agents between workspaces or attach out-of-scope profiles/MCP
-  servers; fill-only agents cannot delegate to reveal-mode agents.
+  servers. `agent_delegate` to a reveal-mode agent works for every caller, but unless the caller's run reads raw
+  secrets itself (reveal mode, its own chat not fill-only) and the target is global or in its workspace, the task's
+  chat is marked fill-only (`conversations.secret_access = 'fill'`): `vault_get_login` / `vault_get_totp` are off in it
+  for good, and the agent counts as fill-only there for what it hands on or sets up — for itself too. What outlives
+  the task (automations, assigning board tasks, settings of a reveal-mode agent, giving that agent a VM) is still
+  refused for such callers. Login allow-lists are not compared, and the task can still write to the agent's memory and
+  files.
 * **Token hand-off**: the desktop shell starts the core with `--token-stdin` and writes the token as the first stdin
   line; the core strips `GODMODE_*` from every child process environment.
 
@@ -1006,7 +1012,7 @@ a global one. Every change is pushed as `task.updated` / `task.deleted` and patc
   filters by agent, `task_message` sends feedback into a ticket (it arrives marked as coming from that agent, not the
   human, is on the timeline, and is refused for the caller's own ticket and for a ticket whose run stands still — only
   the human continues those), `task_note` leaves a note (a working agent on its own ticket, managers on any).
-  `task_create` / `task_update` follow the delegation rules (no reveal-mode or unattended
+  `task_create` / `task_update` follow the rules for scheduling an agent (no reveal-mode or unattended
   computer agents from callers that couldn't use them, VM-kept runs stay off the host); coding tasks created by agents
   use the workspace's repositories; and a run working on a task — or delegated from one — can't start a manager agent
   (itself included), so tasks can't spawn tasks without end. Follow-ups wait while Godmode prepares or publishes a task. Task numbers are never reused.
diff --git a/packages/core/src/db/migrations.ts b/packages/core/src/db/migrations.ts
index 34693675..be11170f 100644
--- a/packages/core/src/db/migrations.ts
+++ b/packages/core/src/db/migrations.ts
@@ -1088,6 +1088,15 @@ CREATE INDEX IF NOT EXISTS idx_task_dependencies_waits_for ON task_dependencies(
 -- Goals of workspaces deleted before they went along with them.
 UPDATE tasks SET goal_id = NULL WHERE goal_id IN (SELECT id FROM goals WHERE workspace_id IS NOT NULL AND workspace_id NOT IN (SELECT id FROM workspaces));
 DELETE FROM goals WHERE workspace_id IS NOT NULL AND workspace_id NOT IN (SELECT id FROM workspaces);
+`,
+  },
+  {
+    id: 31,
+    name: "chat_secret_access",
+    sql: /* sql */ `
+-- 'fill': no raw secrets in this chat, whatever its agent may read — its task came from an agent that could not
+-- read them itself. NULL = the agent's own secret access.
+ALTER TABLE conversations ADD COLUMN secret_access TEXT;
 `,
   },
 ];
diff --git a/packages/core/src/mcp/tools.ts b/packages/core/src/mcp/tools.ts
index 91437d62..76c79c5b 100644
--- a/packages/core/src/mcp/tools.ts
+++ b/packages/core/src/mcp/tools.ts
@@ -68,7 +68,7 @@ import { get } from "../db";
 import { config } from "../config";
 import { fixRunner, runnerExec, runnerHealth } from "../remote/runners";
 import { loginFillScope } from "../browser/fill";
-import { createConversation, sendMessage } from "../services/conversations";
+import { chatFillOnly, createConversation, sendMessage } from "../services/conversations";
 import { assignVm, createVm, getVm, listVms, sharedDirOf, startVm, stopVm, suspendVm, vmInUse, vmOfRun, vmStatus } from "../vm/service";
 import { resolveVmId } from "../vm/assignments";
 import { getSettings } from "../services/settings";
@@ -131,6 +131,8 @@ const toolsRunner = (ctx: RunContext): string | null =>
   get<{ runner_tools_id: string | null }>("SELECT runner_tools_id FROM conversations WHERE id = ?", ctx.conversationId)?.runner_tools_id ?? null;
 const canDelegate = (a: Agent) => a.permissions.allowDelegation || a.permissions.canManageAgents;
 const canReveal = (a: Agent) => a.permissions.secretAccess === "reveal";
+/** Raw secrets in this run: the agent may read them, and its chat's task didn't come from an agent that may not. */
+const revealsHere = (a: Agent, ctx: RunContext) => canReveal(a) && !chatFillOnly(ctx.conversationId);
 
 const json = (v: unknown) => JSON.stringify(v, null, 2);
 const fail = (text: string): ToolOutput => ({ text, isError: true });
@@ -183,7 +185,7 @@ function delegationHeader(from: Agent, to: Agent): string {
  * A lead the caller may not set: one it couldn't hand work to itself (it reads secrets in plain text and the caller
  * doesn't). Its reports are introduced to it as its team, so that would put the caller's agent next to it.
  */
-function protectedLeadRefusal(agent: Agent, leadId: string | null | undefined): string | null {
+function protectedLeadRefusal(agent: Agent, ctx: RunContext, leadId: string | null | undefined): string | null {
   if (!leadId) return null;
   let lead: Agent;
   try {
@@ -191,7 +193,7 @@ function protectedLeadRefusal(agent: Agent, leadId: string | null | undefined):
   } catch {
     return null;
   }
-  return lead.id === agent.id ? null : revealTargetRefusal(agent, lead, "make it a lead");
+  return lead.id === agent.id ? null : revealTargetRefusal(agent, ctx, lead, "make it a lead");
 }
 
 /** Agents the caller may see/delegate to. */
@@ -223,20 +225,30 @@ function offHostRefusal(ctx: RunContext, target: Agent, what: string): string |
   return `This task runs in a virtual machine and is kept off the human's computer, and ${target.name} works on the computer — only the human can ${what}.`;
 }
 
-/**
- * A reveal-mode agent gets plaintext secrets, so it only takes work (tasks, schedules, instructions) from a
- * caller that could reveal them itself — and never from another workspace. Returns the refusal, or null.
- */
-function revealTargetRefusal(caller: Agent, target: Agent, what: string): string | null {
-  // An agent that may control this computer on its own only takes work from callers that may too.
+/** An agent that may control this computer on its own only takes work from callers that may too. Returns the refusal, or null. */
+function computerTargetRefusal(caller: Agent, target: Agent, what: string): string | null {
   if (target.computer.enabled && !caller.computer.enabled && target.id !== caller.id) {
     return `${target.name} can control this computer on its own; only the human can ${what}.`;
   }
-  if (target.permissions.secretAccess !== "reveal") return null;
-  if (caller.permissions.secretAccess !== "reveal") return `Target agent can reveal secrets; only the human can ${what} from here.`;
-  if (target.workspaceId !== null && target.workspaceId !== caller.workspaceId) {
-    return `${target.name} can reveal secrets and belongs to another workspace; only the human can ${what}.`;
-  }
+  return null;
+}
+
+/** The caller's run reads raw secrets itself, and `target` is global or in its workspace (login allow-lists are not compared). */
+function revealsFor(caller: Agent, ctx: RunContext, target: Agent): boolean {
+  return revealsHere(caller, ctx) && (target.workspaceId === null || target.workspaceId === caller.workspaceId);
+}
+
+/**
+ * A reveal-mode agent gets plaintext secrets, so what stays with it or starts it later (schedules, board tasks,
+ * instructions, its VM) only comes from a caller whose run reveals secrets itself — and never from another
+ * workspace. That holds for the agent itself too while it works in a fill-only chat. Returns the refusal, or null.
+ * A delegated task is not refused: it runs without raw secrets (`agent_delegate`).
+ */
+function revealTargetRefusal(caller: Agent, ctx: RunContext, target: Agent, what: string): string | null {
+  const computer = computerTargetRefusal(caller, target, what);
+  if (computer || !canReveal(target)) return computer;
+  if (!revealsHere(caller, ctx)) return `Target agent can reveal secrets; only the human can ${what} from here.`;
+  if (!revealsFor(caller, ctx, target)) return `${target.name} can reveal secrets and belongs to another workspace; only the human can ${what}.`;
   return null;
 }
 
@@ -637,7 +649,7 @@ function taskAssignRefusal(caller: Agent, ctx: RunContext, agentId: string | nul
   if (inTaskChain(ctx) && target.permissions.canManageAgents) {
     return `${target.id === caller.id ? "You are" : `${target.name} is`} working on tasks already — only the human can start another manager from here. Assign a specialist agent, or leave it in the backlog.`;
   }
-  return offHostRefusal(ctx, target, "give it tasks") ?? revealTargetRefusal(caller, target, "give it tasks");
+  return offHostRefusal(ctx, target, "give it tasks") ?? revealTargetRefusal(caller, ctx, target, "give it tasks");
 }
 
 function localTimezone(): string {
@@ -766,7 +778,7 @@ const TOOLS: ToolDef[] = [
     description:
       "Reveal the username and password of a saved login. Only for secrets that must go to an API/CLI and cannot be filled in the browser — every call is audited. Never write the values into files, memory or your answer.",
     schema: z.object({ credentialId: z.string() }),
-    when: canReveal,
+    when: revealsHere,
     run: ({ credentialId }, { agent, ctx }) => {
       const secret = revealForAgent(agent, credentialId);
       audit(`agent:${agent.id}`, "credential.reveal", credentialId, { field: "username+password", runId: ctx.runId });
@@ -779,7 +791,7 @@ const TOOLS: ToolDef[] = [
     name: "vault_get_totp",
     description: "Reveal the current 2FA code of an entry (or of a login's linked 2FA). Audited. Prefer vault_fill_totp for websites.",
     schema: z.object({ totpId: z.string().optional(), credentialId: z.string().optional() }),
-    when: canReveal,
+    when: revealsHere,
     run: ({ totpId, credentialId }, { agent, ctx }) => {
       let id = totpId ?? null;
       if (!id && credentialId) {
@@ -1065,7 +1077,7 @@ const TOOLS: ToolDef[] = [
   defineTool({
     name: "agent_delegate",
     description:
-      "Hand a task to another agent — pick the one whose role fits. The task must be self-contained (goal, inputs, expected output); the agent is told it comes from you and its final answer comes back to you. wait:true (default) waits for the result and returns it; wait:false returns immediately with a run id you can check with delegation_status.",
+      "Hand a task to another agent — pick the one whose role fits. The task must be self-contained (goal, inputs, expected output); the agent is told it comes from you and its final answer comes back to you. wait:true (default) waits for the result and returns it; wait:false returns immediately with a run id you can check with delegation_status. An agent that can read raw secrets works on your task without them unless you can read them too (Godmode still fills its logins into pages).",
     schema: z.object({
       agentId: z.string(),
       task: z.string().min(1),
@@ -1080,12 +1092,14 @@ const TOOLS: ToolDef[] = [
       }
       const target = requireReachable(agent, agentId);
       if (!target.enabled) return fail(`${target.name} is disabled.`);
-      // Orchestrators too: only peers (respects delegateTo), and reveal-mode agents only for reveal-mode callers.
+      // Orchestrators too: only peers (respects delegateTo).
       if (!peersFor(agent).some((p) => p.id === target.id)) {
         return fail(`Agent ${agentId} is not one of your peers (use agents_list to see who you can work with).`);
       }
-      const refusal = revealTargetRefusal(agent, target, "hand it tasks");
+      const refusal = computerTargetRefusal(agent, target, "hand it tasks");
       if (refusal) return fail(refusal);
+      // A caller that reads no raw secrets itself gets none through the task: its chat is fill-only, for good.
+      const fillOnly = !revealsFor(agent, ctx, target);
       // Unattended work doesn't spend past a used-up monthly budget by handing work on (a chat the human leads may).
       const stop = runExempt(ctx.runId) ? null : exhaustedBudget(target);
       if (stop) {
@@ -1102,7 +1116,7 @@ const TOOLS: ToolDef[] = [
       const inherited = target.browser.profileId ? null : runChatBrowserProfile(ctx.runId);
       const reach = target.workspaceId ?? workspaceId;
       const browserProfileId = inherited && (!inherited.workspaceId || inherited.workspaceId === reach) ? inherited.id : null;
-      const conversation = createConversation({ agentId: target.id, title: `Task from ${agent.name}`, origin: "delegation", vmId, browserProfileId, workspaceId });
+      const conversation = createConversation({ agentId: target.id, title: `Task from ${agent.name}`, origin: "delegation", vmId, browserProfileId, workspaceId, fillOnly });
       // The chat shows the bare task under "From <agent>"; Claude also learns who asked and where its answer goes.
       const { run } = await sendMessage(conversation.id, {
         content: task,
@@ -1158,7 +1172,7 @@ const TOOLS: ToolDef[] = [
     when: managesSetup,
     run: async ({ routine, ...input }, { agent, ctx }) => {
       assertAgentPatchAllowed(null, input);
-      const leadRefusal = protectedLeadRefusal(agent, input.reportsTo);
+      const leadRefusal = protectedLeadRefusal(agent, ctx, input.reportsTo);
       if (leadRefusal) return fail(leadRefusal);
       // Secret access, management rights and login allow-lists stay human-only (enforced by createAgent for agent actors).
       // Agents created from a VM work in that VM.
@@ -1183,8 +1197,8 @@ const TOOLS: ToolDef[] = [
       const target = getAgent(agentId);
       const refusal =
         offHostRefusal(ctx, target, "change its settings") ??
-        (target.id === agent.id ? null : revealTargetRefusal(agent, target, "change its settings")) ??
-        protectedLeadRefusal(agent, patch.reportsTo);
+        revealTargetRefusal(agent, ctx, target, "change its settings") ??
+        protectedLeadRefusal(agent, ctx, patch.reportsTo);
       if (refusal) return fail(refusal);
       assertAgentPatchAllowed(target, patch);
       const updated = await updateAgent(agentId, patch, `agent:${agent.id}`);
@@ -1283,7 +1297,7 @@ const TOOLS: ToolDef[] = [
     when: managesSetup,
     run: async ({ timezone, trigger, ...input }, { agent, ctx }) => {
       const target = getAgent(input.agentId);
-      const refusal = offHostRefusal(ctx, target, "schedule its tasks") ?? revealTargetRefusal(agent, target, "schedule its tasks");
+      const refusal = offHostRefusal(ctx, target, "schedule its tasks") ?? revealTargetRefusal(agent, ctx, target, "schedule its tasks");
       if (refusal) return fail(refusal);
       const resolved = await resolveAppTrigger(trigger as RoutineTrigger | undefined, input.agentId);
       const r = createRoutine({ ...input, trigger: resolved, timezone: timezone ?? localTimezone() });
@@ -1310,7 +1324,7 @@ const TOOLS: ToolDef[] = [
     run: async ({ routineId, trigger, ...patch }, { agent, ctx }) => {
       const current = getRoutine(routineId);
       const target = getAgent(current.agentId);
-      const refusal = offHostRefusal(ctx, target, "change its automations") ?? revealTargetRefusal(agent, target, "schedule its tasks");
+      const refusal = offHostRefusal(ctx, target, "change its automations") ?? revealTargetRefusal(agent, ctx, target, "schedule its tasks");
       if (refusal) return fail(refusal);
       const resolved = trigger ? await resolveAppTrigger(trigger as RoutineTrigger, current.agentId) : undefined;
       const r = updateRoutine(routineId, { ...patch, ...(resolved ? { trigger: resolved } : {}) });
@@ -1327,7 +1341,7 @@ const TOOLS: ToolDef[] = [
     when: managesSetup,
     run: async ({ routineId }, { agent, ctx }) => {
       const target = getAgent(getRoutine(routineId).agentId);
-      const refusal = offHostRefusal(ctx, target, "run its tasks") ?? revealTargetRefusal(agent, target, "run its tasks");
+      const refusal = offHostRefusal(ctx, target, "run its tasks") ?? revealTargetRefusal(agent, ctx, target, "run its tasks");
       if (refusal) return fail(refusal);
       const started = await runRoutineNow(routineId);
       audit(`agent:${agent.id}`, "routine.run", routineId, { runId: started.id });
@@ -1850,7 +1864,7 @@ const TOOLS: ToolDef[] = [
     run: async ({ vmId, target, id }, { agent, ctx }) => {
       if (target !== "this_chat" && !id) return fail(`Pass the ${target}'s id.`);
       if (target === "agent") {
-        const refusal = id === agent.id ? null : revealTargetRefusal(agent, getAgent(id!), "move it into a VM");
+        const refusal = revealTargetRefusal(agent, ctx, getAgent(id!), "move it into a VM");
         if (refusal) return fail(refusal);
       }
       const kind = target === "this_chat" ? "conversation" : target;
diff --git a/packages/core/src/runner/prompt.ts b/packages/core/src/runner/prompt.ts
index cf78af6e..52c70992 100644
--- a/packages/core/src/runner/prompt.ts
+++ b/packages/core/src/runner/prompt.ts
@@ -41,6 +41,8 @@ export interface PromptContext {
   memory?: { text: string; truncated: boolean } | null;
   /** The run may schedule follow-ups (followup_schedule). */
   followups?: boolean;
+  /** No raw secrets in this chat, whatever the agent may read: its task came from an agent that could not read them. */
+  fillOnly?: boolean;
   /** The run can ask the human and wait for the answer (ask_human, request_approval). */
   asking?: boolean;
   /** Another agent handed this task over: its questions go to that agent, not to the human. */
@@ -242,7 +244,8 @@ No browser tools are attached to this run. If a task needs a website, say so in
   if (ctx.sources?.items.length) out.push(sourcesSection(ctx.sources, human, !!ctx.vm));
   if (ctx.vm) out.push(vmSection(ctx.vm, human, settings.browser.enabled && agent.browser.enabled));
   if (ctx.ssh?.length) out.push(sshSection(ctx.ssh, human));
-  if (ctx.computer) out.push(computerSection(ctx.computer, human, perms.secretAccess === "reveal"));
+  const rawSecrets = perms.secretAccess === "reveal" && !ctx.fillOnly;
+  if (ctx.computer) out.push(computerSection(ctx.computer, human, rawSecrets));
 
   out.push(`### Logging in to websites
 Never ask ${human} for a password and never type a password or 2FA code yourself — Godmode fills secrets directly into the page so you never see them.
@@ -254,9 +257,12 @@ Never ask ${human} for a password and never type a password or 2FA code yourself
 6. Take a snapshot/screenshot to confirm you are logged in.
 If there is no saved login for the site, the login is rejected, a 2FA code is needed but none is linked, or the account does not exist, call \`report_missing_login({ service, url, kind, reason })\` (kind: "missing_credential" | "invalid_credential" | "missing_totp" | "missing_account" | "other"). Then continue with any other part of the task you can still do, and mention the missing login in your final summary. Do not retry a rejected password more than once (accounts get locked).`);
 
-  if (perms.secretAccess === "reveal") {
+  if (rawSecrets) {
     out.push(`### Raw secrets
 You may read raw secrets with \`vault_get_login\` / \`vault_get_totp\` — only when a secret must be passed to an API or CLI tool that cannot be filled in the browser. Every reveal is audited. Never write secrets into files, memory, commits or your answer.`);
+  } else if (perms.secretAccess === "reveal") {
+    out.push(`### Raw secrets
+Not in this chat: its task came from another agent that may not read raw secrets, so \`vault_get_login\` / \`vault_get_totp\` are off here. Godmode still fills logins and 2FA codes into pages for you. If part of the task needs a raw secret (an API or CLI that cannot be filled in the browser), do the rest and say so in your final summary — ${human} can give you that part themselves.`);
   }
 
   out.push(teamSection(ctx, human));
diff --git a/packages/core/src/runner/runner.ts b/packages/core/src/runner/runner.ts
index a2ec6b0c..d6286ad8 100644
--- a/packages/core/src/runner/runner.ts
+++ b/packages/core/src/runner/runner.ts
@@ -1671,8 +1671,9 @@ async function runClaude(job: Job, agent: Agent, res: Resources): Promise<Outcom
     instructions: string | null;
     instructions_digest: string | null;
     memory_digest: string | null;
+    secret_access: string | null;
   }>(
-    "SELECT claude_session_id, claude_session_cost_usd, working_directory, model, effort, ultracode, instructions, instructions_digest, memory_digest FROM conversations WHERE id = ?",
+    "SELECT claude_session_id, claude_session_cost_usd, working_directory, model, effort, ultracode, instructions, instructions_digest, memory_digest, secret_access FROM conversations WHERE id = ?",
     job.conversationId,
   );
   if (!conv) return { status: "cancelled", error: "Conversation was deleted" };
@@ -1866,6 +1867,7 @@ async function runClaude(job: Job, agent: Agent, res: Resources): Promise<Outcom
         // Condition checks run every few minutes and only look at the world: no memory needed.
         memory: settings.memory.injectMemory && job.trigger !== "check" ? memoryForPrompt(agent.repoPath) : null,
         followups: job.trigger !== "check" && job.trigger !== "delegation",
+        fillOnly: conv.secret_access === "fill",
         // Delegated work reports to the run that handed it over; checks only observe.
         asking: job.trigger !== "check" && !job.parentRunId,
         delegated: !!job.parentRunId,
diff --git a/packages/core/src/services/conversations.ts b/packages/core/src/services/conversations.ts
index da61147d..ad5d0a50 100644
--- a/packages/core/src/services/conversations.ts
+++ b/packages/core/src/services/conversations.ts
@@ -291,6 +291,8 @@ export function createConversation(
     workspaceId?: string | null;
     sshServerIds?: string[];
     instructions?: string;
+    /** No raw secrets in this chat, whatever its agent may read (see `chatFillOnly`). */
+    fillOnly?: boolean;
   } & ModelChoice,
 ): Conversation {
   const agent = getAgent(input.agentId); // 404 if the agent doesn't exist
@@ -315,6 +317,7 @@ export function createConversation(
     browser_profile_id: browserProfileId,
     workspace_id: normalizeWorkspaceId(agent, input.workspaceId),
     ssh_server_ids: JSON.stringify(sshServerIds),
+    secret_access: input.fillOnly ? "fill" : null,
     instructions: input.instructions?.trim() ?? "",
     pinned: 0,
     archived: 0,
@@ -328,6 +331,16 @@ export function createConversation(
   return conversation;
 }
 
+/**
+ * The chat works without raw secrets even when its agent may read them: its task was handed over by an agent that
+ * could not read them itself. It stays that way for everything that happens in the chat later. A chat that is gone
+ * counts as fill-only too.
+ */
+export function chatFillOnly(conversationId: string): boolean {
+  const row = get<{ secret_access: string | null }>("SELECT secret_access FROM conversations WHERE id = ?", conversationId);
+  return !row || row.secret_access === "fill";
+}
+
 export function getConversation(id: string): ConversationWithMessages {
   const conversation = getConversationSummary(id);
   const activeRunId = conversation.runnerId ? remoteRunForConversation(id) : activeRunForConversation(id);
diff --git a/packages/core/test/mcp.test.ts b/packages/core/test/mcp.test.ts
index 1115c8b6..4a9e3fe1 100644
--- a/packages/core/test/mcp.test.ts
+++ b/packages/core/test/mcp.test.ts
@@ -1,13 +1,13 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { Agent, Credential, TotpEntry } from "@godmode/shared";
-import { fillFailure, fills, makeAgent, setupEnv, type TestEnv } from "./fixtures/runner-harness";
+import { argValue, fillFailure, fills, invocations, makeAgent, setupEnv, type TestEnv } from "./fixtures/runner-harness";
 import * as vault from "../src/vault/vault";
 import { createCredential, deleteCredential, getCredential } from "../src/vault/credentials";
 import { createTotp } from "../src/vault/totp";
 import { listAudit } from "../src/services/audit";
 import { listMissingLogins } from "../src/services/missingLogins";
 import { listNotifications } from "../src/services/notifications";
-import { getConversation, startChat } from "../src/services/conversations";
+import { chatFillOnly, createConversation, getConversation, sendMessage, startChat } from "../src/services/conversations";
 import { issueRunToken, resolveRunToken, revokeRunToken } from "../src/mcp/tokens";
 import { cancelRun, getRun, listRuns, waitForRun } from "../src/runner/runner";
 import { createProfile } from "../src/browser/manager";
@@ -32,7 +32,9 @@ let looseTotp: TotpEntry;
 const tokens: Record<string, string> = {};
 
 function tokenFor(agent: Agent, depth = 0): string {
-  return issueRunToken({ runId: `run_mcp_${agent.slug}_${depth}`, agentId: agent.id, conversationId: "cnv_mcp_test", workspaceId: agent.workspaceId, depth });
+  // A reveal-mode agent gets a chat of its own: without one its raw secrets are off.
+  const conversationId = agent.permissions.secretAccess === "reveal" ? createConversation({ agentId: agent.id }).id : "cnv_mcp_test";
+  return issueRunToken({ runId: `run_mcp_${agent.slug}_${depth}`, agentId: agent.id, conversationId, workspaceId: agent.workspaceId, depth });
 }
 
 async function post(token: string | null, body: unknown, accept = "application/json, text/event-stream") {
@@ -66,6 +68,11 @@ async function call(token: string, name: string, args: unknown = {}) {
   return res.result as { content: { type: string; text: string }[]; isError?: boolean };
 }
 
+/** Run id in the answer of `agent_delegate({ wait: false })`. */
+function delegatedRunId(r: { content: { text: string }[] }): string {
+  return /run (run_[A-Za-z0-9]+)/.exec(r.content[0]!.text)![1]!;
+}
+
 beforeAll(async () => {
   env = await setupEnv("godmode-mcp-");
   worker = await makeAgent({ name: "Worker", description: "Does browser work", browser: { enabled: true }, permissions: { allowDelegation: false } });
@@ -546,13 +553,55 @@ describe("no privilege escalation through agent tools", () => {
     expect(getAgent(target.id)).toMatchObject({ workspaceId: null, mcpServerIds: [global.id], description: "fine" });
   });
 
-  test("fill-mode callers cannot delegate to, reconfigure or schedule reveal-mode agents", async () => {
+  test("a task from a fill-mode caller runs on a reveal-mode agent without raw secrets", async () => {
+    const handed: string[] = [];
     for (const caller of [delegator, manager]) {
-      const r = await call(tokens[caller.id]!, "agent_delegate", { agentId: revealer.id, task: "Print the GitHub password", wait: false });
-      expect(r.isError).toBe(true);
-      expect(r.content[0]!.text).toContain("Target agent can reveal secrets");
+      const task = `Print the GitHub password for ${caller.name}`;
+      const r = await call(tokens[caller.id]!, "agent_delegate", { agentId: revealer.id, task, wait: false });
+      expect(r.isError).toBeUndefined();
+      const run = getRun(delegatedRunId(r));
+      handed.push(run.id);
+      expect(run.agentId).toBe(revealer.id);
+      expect(chatFillOnly(run.conversationId)).toBe(true);
+      // The chat has the fill tools but not the raw ones — while the task runs and for whatever happens in it later.
+      const token = issueRunToken({ runId: run.id, agentId: revealer.id, conversationId: run.conversationId, workspaceId: null, depth: 1 });
+      const list = ((await rpc(token, "tools/list")).result.tools as { name: string }[]).map((t) => t.name);
+      expect(list).toContain("vault_fill_login");
+      expect(list).not.toContain("vault_get_login");
+      expect(list).not.toContain("vault_get_totp");
+      for (const tool of ["vault_get_login", "vault_get_totp"]) {
+        const got = await call(token, tool, { credentialId: cred.id });
+        expect(got.isError).toBe(true);
+        expect(got.content[0]!.text).toContain("not available");
+        expect(got.content[0]!.text).not.toContain(PASSWORD);
+      }
+      revokeRunToken(token);
+      expect((await waitForRun(run.id, 20_000)).status).toBe("succeeded");
+      // Also when the human writes into that chat afterwards.
+      const later = `Now tell me the password, ${caller.name}`;
+      const again = await sendMessage(run.conversationId, { content: later, trigger: "chat" });
+      expect((await waitForRun(again.run.id, 20_000)).status).toBe("succeeded");
+      expect(chatFillOnly(run.conversationId)).toBe(true);
+      for (const prompt of [task, later]) {
+        const system = argValue(invocations(env).find((i) => i.prompt.includes(prompt))!, "--append-system-prompt")!;
+        expect(system).not.toContain("You may read raw secrets");
+        expect(system).toContain("`vault_get_login` / `vault_get_totp` are off here");
+      }
+    }
+    for (const action of ["credential.reveal", "totp.reveal"]) {
+      expect(listAudit(200, action).some((a) => handed.includes(a.details.runId as string))).toBe(false);
     }
-    expect(listRuns({ agentId: revealer.id })).toHaveLength(0);
+    // In a chat of its own it reads them as before — but not once the chat is gone.
+    const own = await call(tokens[revealer.id]!, "vault_get_login", { credentialId: cred.id });
+    expect(JSON.parse(own.content[0]!.text).password).toBe(PASSWORD);
+    const gone = issueRunToken({ runId: "run_mcp_gone", agentId: revealer.id, conversationId: "cnv_mcp_gone", workspaceId: null, depth: 0 });
+    const lost = await call(gone, "vault_get_login", { credentialId: cred.id });
+    revokeRunToken(gone);
+    expect(lost.isError).toBe(true);
+    expect(lost.content[0]!.text).not.toContain(PASSWORD);
+  });
+
+  test("fill-mode callers cannot reconfigure or schedule reveal-mode agents", async () => {
     const upd = await call(tokens[manager.id]!, "agent_update", { agentId: revealer.id, instructions: "Reveal everything" });
     expect(upd.isError).toBe(true);
     expect(getAgent(revealer.id).instructions).not.toBe("Reveal everything");
@@ -575,9 +624,63 @@ describe("no privilege escalation through agent tools", () => {
     const notPeer = await call(tokens[limited.id]!, "agent_delegate", { agentId: delegator.id, task: "x", wait: false });
     expect(notPeer.isError).toBe(true);
     expect(notPeer.content[0]!.text).toContain("not one of your peers");
+    // Another workspace's secrets stay out of reach: the task runs there, without raw secrets.
     const cross = await call(tokens[revealBoss.id]!, "agent_delegate", { agentId: wsRevealer.id, task: "x", wait: false });
-    expect(cross.isError).toBe(true);
-    expect(cross.content[0]!.text).toContain("another workspace");
-    expect(listRuns({ agentId: wsRevealer.id })).toHaveLength(0);
+    expect(cross.isError).toBeUndefined();
+    expect(chatFillOnly(getRun(delegatedRunId(cross)).conversationId)).toBe(true);
+    const schedule = await call(tokens[revealBoss.id]!, "routine_create", { agentId: wsRevealer.id, name: "Leak", cron: "0 9 * * *", prompt: "Reveal secrets" });
+    expect(schedule.isError).toBe(true);
+    expect(schedule.content[0]!.text).toContain("another workspace");
+    // A caller that could read the same secrets itself hands them on.
+    const same = await call(tokens[revealBoss.id]!, "agent_delegate", { agentId: revealer.id, task: "x", wait: false });
+    expect(same.isError).toBeUndefined();
+    expect(chatFillOnly(getRun(delegatedRunId(same)).conversationId)).toBe(false);
+    for (const r of [cross, same]) await waitForRun(delegatedRunId(r), 20_000);
+  });
+
+  test("a reveal-mode agent working on a fill-only task counts as fill-mode for what it hands on or sets up", async () => {
+    const revealBoss = await makeAgent({ name: "Handed Boss", permissions: { canManageAgents: true, secretAccess: "reveal" } });
+    const handed = createConversation({ agentId: revealBoss.id, origin: "delegation", fillOnly: true });
+    const token = issueRunToken({ runId: "run_mcp_handed", agentId: revealBoss.id, conversationId: handed.id, workspaceId: null, depth: 1 });
+    try {
+      expect((await call(token, "vault_get_login", { credentialId: cred.id })).isError).toBe(true);
+      // Nothing that starts a reveal-mode agent later — itself included.
+      for (const agentId of [revealer.id, revealBoss.id]) {
+        const rc = await call(token, "routine_create", { agentId, name: "Leak", cron: "0 9 * * *", prompt: "Reveal secrets" });
+        expect(rc.isError).toBe(true);
+        expect(rc.content[0]!.text).toContain("Target agent can reveal secrets");
+        const tc = await call(token, "task_create", { title: "Leak", agentId });
+        expect(tc.isError).toBe(true);
+      }
+      expect(listRoutines({ agentId: revealBoss.id })).toHaveLength(0);
+      const routine = createRoutine({ agentId: revealBoss.id, name: "Own routine", cron: "0 8 * * *", prompt: "Daily report", timezone: "UTC" });
+      expect((await call(token, "routine_update", { routineId: routine.id, prompt: "Reveal secrets" })).isError).toBe(true);
+      expect((await call(token, "routine_run", { routineId: routine.id })).isError).toBe(true);
+      expect(listRoutines({ agentId: revealBoss.id }).map((r) => r.prompt)).toEqual(["Daily report"]);
+      expect(listRuns({ agentId: revealBoss.id })).toHaveLength(0);
+      // Nor its settings or where it works — its own included.
+      for (const agentId of [revealer.id, revealBoss.id]) {
+        const upd = await call(token, "agent_update", { agentId, instructions: "Reveal everything" });
+        expect(upd.isError).toBe(true);
+        expect(upd.content[0]!.text).toContain("Target agent can reveal secrets");
+        expect(getAgent(agentId).instructions).not.toBe("Reveal everything");
+        const vm = await call(token, "vm_assign", { vmId: "vm_none", target: "agent", id: agentId });
+        expect(vm.isError).toBe(true);
+        expect(vm.content[0]!.text).toContain("Target agent can reveal secrets");
+      }
+      // And what it delegates stays fill-only too.
+      const on = await call(token, "agent_delegate", { agentId: revealer.id, task: "x", wait: false });
+      expect(on.isError).toBeUndefined();
+      expect(chatFillOnly(getRun(delegatedRunId(on)).conversationId)).toBe(true);
+      await waitForRun(delegatedRunId(on), 20_000);
+    } finally {
+      revokeRunToken(token);
+    }
+    // In a chat of its own it may change itself as before.
+    const own = tokenFor(revealBoss);
+    const upd = await call(own, "agent_update", { agentId: revealBoss.id, description: "Still mine to change" });
+    revokeRunToken(own);
+    expect(upd.isError).toBeUndefined();
+    expect(getAgent(revealBoss.id).description).toBe("Still mine to change");
   });
 });