diff --git a/packages/cli-workflow/src/commands/init/workspace.ts b/packages/cli-workflow/src/commands/init/workspace.ts
index 6534067..9bd1a8a 100644
--- a/packages/cli-workflow/src/commands/init/workspace.ts
+++ b/packages/cli-workflow/src/commands/init/workspace.ts
@@ -45,6 +45,8 @@ function biomeJson(): string {
     {
       $schema: "https://biomejs.dev/schemas/2.4.14/schema.json",
       files: {
+        // Exclude generated bundle script — it uses Bun globals and console that
+        // conflict with the workspace's Biome rules (noConsole, etc.).
         includes: ["**", "!**/node_modules", "!**/dist", "!scripts/bundle.ts"],
       },
       formatter: {
diff --git a/packages/cli-workflow/src/commands/setup/dispatch.ts b/packages/cli-workflow/src/commands/setup/dispatch.ts
index 807b369..7499830 100644
--- a/packages/cli-workflow/src/commands/setup/dispatch.ts
+++ b/packages/cli-workflow/src/commands/setup/dispatch.ts
@@ -150,6 +150,8 @@ async function collectInteractiveSetup(): Promise<Result<SetupCliArgs, string>>
     if (baseUrl === "") {
       return err("base URL must not be empty");
     }
+    // Note: readline does not support masked input; API key is visible during entry.
+    // Acceptable for a local dev CLI — not a production-facing prompt.
     const apiKey = await promptLine(rl, "API key: ");
     if (apiKey === "") {
       return err("API key must not be empty");