secrets: polish key manager and docs

crates/tui/src/keys.rs

@@ -239,16 +239,44 @@ pub async fn launch() -> ExitCode {
 
 type UiResult<T> = Result<T, Box<dyn std::error::Error>>;
 
+struct TerminalRestoreGuard {
+    active: bool,
+}
+
+impl TerminalRestoreGuard {
+    fn new() -> Self {
+        Self { active: true }
+    }
+
+    fn restore(mut self) {
+        self.cleanup();
+        self.active = false;
+    }
+
+    fn cleanup(&mut self) {
+        let _ = execute!(io::stdout(), crossterm::cursor::Show, LeaveAlternateScreen);
+        let _ = disable_raw_mode();
+    }
+}
+
+impl Drop for TerminalRestoreGuard {
+    fn drop(&mut self) {
+        if self.active {
+            self.cleanup();
+        }
+    }
+}
+
 fn run(store: SecretStore) -> UiResult<()> {
     enable_raw_mode()?;
+    let guard = TerminalRestoreGuard::new();
     let mut stdout = io::stdout();
     execute!(stdout, EnterAlternateScreen, crossterm::cursor::Hide)?;
     let backend = CrosstermBackend::new(stdout);
     let mut terminal = Terminal::new(backend)?;
     let result = run_loop(&mut terminal, store);
-    let mut stdout = io::stdout();
-    let _ = execute!(stdout, crossterm::cursor::Show, LeaveAlternateScreen);
-    let _ = disable_raw_mode();
+    drop(terminal);
+    guard.restore();
     result
 }
 

docs/environment.md

@@ -43,10 +43,8 @@ Builtin profiles and catalogs are embedded in the binary at build time. User/pro
 Provider API key と WebSearch credential は、通常の runtime では環境変数から読まない。`insomnia keys` で local secret store に論理 id を追加し、profile / manifest / provider catalog / web config がその id を明示的に参照する。
 
 ```toml
-[[models]]
-id = "anthropic/claude-sonnet-4"
-scheme = "anthropic"
-model = "claude-sonnet-4-20250514"
+[model]
+ref = "anthropic/claude-sonnet-4-6"
 auth = { kind = "secret_ref", ref = "providers/anthropic/default" }
 
 [web]