@arcforgelabs/flow 2026.10.35 → 2026.10.37

package/README.md

@@ -48,6 +48,7 @@ run a lab.
 | `docs/CUSTOM_FIELDS.md` | Custom fields: the lab's own fields for its jobs, kept in Flow only, and how a board move checks for conflicts |
 | `docs/JOB_BOARD_MOVES.md` | Moving jobs on the Jobs board: custom field moves stay in Flow; Seazona stage moves become a hand-off |
 | `docs/PRICE_LIST.md` | The price list: Flow's own codes and prices, their links to Xero items and Seazona products, and the price check |
+| `docs/AI_BOTS.md` | The AI bots: ClawSweeper reviews and the Docs Agent, their ClawRouter budget and cost, and setup |
 | `docs/LOW_RISK_MERGE.md` | The low-risk merge lane: which pull requests merge themselves when green, with ClawSweeper's risk labels |
 | `docs/RELEASING.md` | Versions and channels, the release workflows, how to cut and roll back a release, and the one-time setup |
 | `docs/SELF_HOSTING.md` | Running a Flow release with Docker, Node or Replit, the update notice, and Clerk sign-in |

package/npm-shrinkwrap.json

@@ -1,15 +1,15 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.35",
+  "version": "2026.10.37",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.10.35",
+      "version": "2026.10.37",
       "license": "MIT",
       "dependencies": {
-        "@clerk/backend": "3.23.2",
+        "@clerk/backend": "3.25.0",
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/dm-sans": "5.3.0",
         "@fontsource-variable/geist": "5.3.0",
@@ -21,10 +21,11 @@
         "@fontsource-variable/playfair-display": "5.3.0",
         "@fontsource-variable/plus-jakarta-sans": "5.3.0",
         "@fontsource-variable/space-grotesk": "5.3.0",
-        "@sentry/node": "11.4.0",
-        "drizzle-orm": "0.45.3",
+        "@sentry/node": "11.8.0",
+        "drizzle-orm": "0.45.4",
         "express": "5.3.0",
-        "express-rate-limit": "8.7.0",
+        "express-rate-limit": "8.7.1",
+        "lucide-static": "1.59.0",
         "pdfkit": "0.20.2",
         "pg": "8.23.1"
       },
@@ -39,9 +40,9 @@
       }
     },
     "node_modules/@clerk/backend": {
-      "version": "3.23.2",
-      "resolved": "https://registry.npmjs.org/@clerk/backend/-/backend-3.23.2.tgz",
-      "integrity": "sha512-QW2qJPY7xQyn5SrNWJ+xO7o6va60X9/v4nX8y5zq8OJFS10X7GlEz8s5PDKTgo6W6SWb8L3APhrZH+LTp7yuNw==",
+      "version": "3.25.0",
+      "resolved": "https://registry.npmjs.org/@clerk/backend/-/backend-3.25.0.tgz",
+      "integrity": "sha512-hmJS0a61FO08PDaV2MtZ/hj6pE+cQBRmpxR8oUFGQTXewOQLLOAbcgob0rmFAnMNuHgXfsYf3NVxcQCUOWE+QA==",
       "license": "MIT",
       "dependencies": {
         "@clerk/shared": "^4.40.0",
@@ -809,6 +810,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -825,6 +829,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -841,6 +848,9 @@
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -857,6 +867,9 @@
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -873,6 +886,9 @@
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -889,6 +905,9 @@
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -905,6 +924,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -921,6 +943,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1004,12 +1029,12 @@
       }
     },
     "node_modules/@sentry/bundler-plugins": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/bundler-plugins/-/bundler-plugins-11.4.0.tgz",
-      "integrity": "sha512-THgOMIaA0AMVF4TiCIbugK2jlLYCBIhRF0gclrj7Fte3RMZytkXeH8XeoaR6C6MJTyLCNkEOEccwX9Jj2xOc8g==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/bundler-plugins/-/bundler-plugins-11.8.0.tgz",
+      "integrity": "sha512-rQrbL2lYPyiiO6ngdpbbfPKyEzVVQsz1FG+aE8jUiUYs72gvmDmZmRyl9VDCGLrHZfIEwaQMT1t6WQH5nopu5A==",
       "license": "MIT",
       "dependencies": {
-        "@sentry/core": "11.4.0",
+        "@sentry/core": "11.8.0",
         "dotenv": "^17.4.2",
         "glob": "^13.0.6",
         "magic-string": "~0.30.8 || ^1.0.0",
@@ -1038,52 +1063,52 @@
       }
     },
     "node_modules/@sentry/conventions": {
-      "version": "0.25.0",
-      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.25.0.tgz",
-      "integrity": "sha512-7SouCAX3qx+AzLsxb6gbl3dKVWNhp2wFjdYQ/T90sGwqPPQUoZVA9YwsWwvx07hqcCiSqFW9mUAzyUftASnuhQ==",
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.27.0.tgz",
+      "integrity": "sha512-Mrqd/o7n/z7qWSYfQQA7x4fFTA0IqOG6JNsbBpnC97khPwZk7n6DPtOO7YgaYplSl8R8QLRbBz9Xv2lVhToSAg==",
       "license": "MIT",
       "engines": {
         "node": ">=14"
       }
     },
     "node_modules/@sentry/core": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-11.4.0.tgz",
-      "integrity": "sha512-kAhK8XVJuzu1IKx9uSu04OISxTU9BcIyDVOWbY/ATUCYr5Z6L7GRBtOGOlYCbxEuPtdZCw5TrbphnBsyO9fuTA==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-11.8.0.tgz",
+      "integrity": "sha512-4MVTthk6C/1oQFjbVIfygHyNkx2YGbwNLml0kJji0vjJXy6ZNls9zdIp0FTBTi4e3189IcSc5OXD4qcJdmEeKA==",
       "license": "MIT",
       "dependencies": {
-        "@sentry/conventions": "^0.25.0"
+        "@sentry/conventions": "^0.27.0"
       },
       "engines": {
         "node": ">=20.19.0 <22.0.0 || >=22.12.0 <23.0.0 || >=23.2.0"
       }
     },
     "node_modules/@sentry/node": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/node/-/node-11.4.0.tgz",
-      "integrity": "sha512-fW587LsZnsuGt1V++59xFCtZ/7jGO3GQq1F+l/Jx5DS18QApXQ99vlfS9H5bxuWixfi5/22ea9M8XjFpkkuzQg==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/node/-/node-11.8.0.tgz",
+      "integrity": "sha512-8vFPfCRYoUYmsno+OYdvtf5akIUUvd7FvcuIGcfrge8S/bSLFRKq58YtFmX25JFcrMNZ2oQD8r0jkgZfm/2iuA==",
       "license": "MIT",
       "dependencies": {
         "@opentelemetry/api": "^1.9.1",
-        "@sentry/bundler-plugins": "11.4.0",
-        "@sentry/conventions": "^0.25.0",
-        "@sentry/core": "11.4.0",
-        "@sentry/opentelemetry": "11.4.0",
-        "@sentry/server-runtime-injection": "11.4.0",
-        "@sentry/server-utils": "11.4.0"
+        "@sentry/bundler-plugins": "11.8.0",
+        "@sentry/conventions": "^0.27.0",
+        "@sentry/core": "11.8.0",
+        "@sentry/opentelemetry": "11.8.0",
+        "@sentry/server-runtime-injection": "11.8.0",
+        "@sentry/server-utils": "11.8.0"
       },
       "engines": {
         "node": ">=20.19.0 <22.0.0 || >=22.12.0 <23.0.0 || >=23.2.0"
       }
     },
     "node_modules/@sentry/opentelemetry": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-11.4.0.tgz",
-      "integrity": "sha512-GGDmV+VIGU1p3KGtgR32wrRJejSfEuafbEcSUK7Ww5oxDMYJyHXRSbFjVvGMoAG1ezTl0U6WtMUoWmalsfYHZg==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-11.8.0.tgz",
+      "integrity": "sha512-wKuG2SbHHiGDT/fgT4X5n2usO4AjVkYfAj41002mZ18JZU3mNLeCq+qw/nnDIYbcsfIMOUm/eMh3ShKCE+DpXQ==",
       "license": "MIT",
       "dependencies": {
-        "@sentry/conventions": "^0.25.0",
-        "@sentry/core": "11.4.0"
+        "@sentry/conventions": "^0.27.0",
+        "@sentry/core": "11.8.0"
       },
       "engines": {
         "node": ">=20.19.0 <22.0.0 || >=22.12.0 <23.0.0 || >=23.2.0"
@@ -1093,27 +1118,27 @@
       }
     },
     "node_modules/@sentry/server-runtime-injection": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/server-runtime-injection/-/server-runtime-injection-11.4.0.tgz",
-      "integrity": "sha512-8IaiqIJuJySztjxdC0UXP3lHlBAr8HsI8kUMEDV7REYhgmz2+B4BmKyyvaZfeasJlAvzkvSOLZ/Xco7kPikZdQ==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/server-runtime-injection/-/server-runtime-injection-11.8.0.tgz",
+      "integrity": "sha512-4uB4E8+9ni5NcJ463aYK/+n1hTMw/vSt4s+AkQ84CKigRDwv2FNNnD1AWpipWNj/xEQ6eQbUitGl7wg7/Ri8Pg==",
       "license": "MIT",
       "dependencies": {
-        "@sentry/core": "11.4.0",
-        "@sentry/server-utils": "11.4.0"
+        "@sentry/core": "11.8.0",
+        "@sentry/server-utils": "11.8.0"
       },
       "engines": {
         "node": ">=20.19.0 <22.0.0 || >=22.12.0 <23.0.0 || >=23.2.0"
       }
     },
     "node_modules/@sentry/server-utils": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-11.4.0.tgz",
-      "integrity": "sha512-GA4RvjRXyKFawD7Zi5AlgHPvm9Q8d9VeWer6g9qj4mDavi+VuNFhRmhgsv1qU1l3hlUeMYCpbKhpDOaOH/TcoQ==",
+      "version": "11.8.0",
+      "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-11.8.0.tgz",
+      "integrity": "sha512-2MRFz1rXxnuDGafl6o/itwKHZeZn5hUZYeXNbQK012uO/a2pXhEc8Zh3FeO5L4tjGrIWHx419saAFnKwbVC2IQ==",
       "license": "MIT",
       "dependencies": {
         "@opentelemetry/api": "^1.9.1",
-        "@sentry/conventions": "^0.25.0",
-        "@sentry/core": "11.4.0"
+        "@sentry/conventions": "^0.27.0",
+        "@sentry/core": "11.8.0"
       },
       "engines": {
         "node": ">=20.19.0 <22.0.0 || >=22.12.0 <23.0.0 || >=23.2.0"
@@ -1399,9 +1424,9 @@
       }
     },
     "node_modules/drizzle-orm": {
-      "version": "0.45.3",
-      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.3.tgz",
-      "integrity": "sha512-CAloER21cDdcgZ1OmjrZX82EeRNsdP+y0onX/eyoYDaYzki/adrAa91lzM5jWh7zZPK4qUbw/6LGv9J+A+uizA==",
+      "version": "0.45.4",
+      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.4.tgz",
+      "integrity": "sha512-NiM1YZpJ2UxyeE67DpDDZ+Tsw4YLX3trSlkNT7Tm9eKoUNb1LvaAaQzXgYQsWs+AQ9TUmmwMmBOCXuqqxUWKKQ==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "@aws-sdk/client-rds-data": ">=3",
@@ -1687,9 +1712,9 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz",
-      "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==",
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.1.tgz",
+      "integrity": "sha512-2FXbqkygil3mZiXzEtM0IjE/UBmBNot0J1GEVrJT4JbrvwOSoEtqtO+wHbiMQELWe1eNvHoYRg2dkjOid+6JkA==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.4.3",
@@ -2021,6 +2046,12 @@
         "node": "20 || >=22"
       }
     },
+    "node_modules/lucide-static": {
+      "version": "1.59.0",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.59.0.tgz",
+      "integrity": "sha512-MuHZYaXbHgzN2QO6D3OM19bj09A+8GJiFSdXIMlbnLLEGQQ9+NRH2KaCxuivevD3Y23vM74kV17XBifgtqhfEg==",
+      "license": "ISC"
+    },
     "node_modules/magic-string": {
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.35",
+  "version": "2026.10.37",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
     "db:generate": "drizzle-kit generate && node scripts/db-guard-migrations.js"
   },
   "dependencies": {
-    "@clerk/backend": "3.23.2",
+    "@clerk/backend": "3.25.0",
     "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
     "@fontsource-variable/dm-sans": "5.3.0",
     "@fontsource-variable/geist": "5.3.0",
@@ -49,10 +49,11 @@
     "@fontsource-variable/playfair-display": "5.3.0",
     "@fontsource-variable/plus-jakarta-sans": "5.3.0",
     "@fontsource-variable/space-grotesk": "5.3.0",
-    "@sentry/node": "11.4.0",
-    "drizzle-orm": "0.45.3",
+    "@sentry/node": "11.8.0",
+    "drizzle-orm": "0.45.4",
     "express": "5.3.0",
-    "express-rate-limit": "8.7.0",
+    "express-rate-limit": "8.7.1",
+    "lucide-static": "1.59.0",
     "pdfkit": "0.20.2",
     "pg": "8.23.1"
   },

package/server/api/invoicing.js

@@ -236,6 +236,22 @@ const jobOf = (o) => (o ? {
   id: o.id, sourceSystem: o.sourceSystem, sourceJobRef: o.sourceJobRef, caseRef: o.caseRef, practitioner: o.practitioner, shippedOn: o.shippedOn,
 } : null);
 
+// A job with its work system's name and its link in that system's web app
+// (jobLink: no live call), for the Linked column.
+function withLink(job, systems) {
+  if (!job) return null;
+  const source = systems.find((a) => a.id === job.sourceSystem) ?? null;
+  const link = typeof source?.capabilities.jobLink === 'function' ? source.capabilities.jobLink({ sourceJobRef: job.sourceJobRef }) : null;
+  return { ...job, systemName: source?.name ?? job.sourceSystem, link: link ?? null };
+}
+
+// The connected systems an invoice can link to: work systems, then the
+// accounting system.
+const linkedSystems = (work, accounting) => [
+  ...work.map((a) => ({ id: a.id, name: a.name, kind: 'work' })),
+  ...(accounting ? [{ id: accounting.id, name: accounting.name, kind: 'accounting' }] : []),
+];
+
 async function jobsByInvoice(db, organisationId, invoiceIds) {
   if (!invoiceIds.length) return new Map();
   const rows = await db.select().from(billingObligations)
@@ -282,7 +298,9 @@ async function invoiceDetail(db, organisationId, invoiceId, accounting = null, w
       ? { mode: await sendModeFor(db, organisationId, invoice.contactId), otherCustomers: 0, ...(await accounting.capabilities.sendStatus({ organisationId })) }
       : null,
     contact: contact ?? null,
-    job: jobs.get(invoiceId) ?? null,
+    job: withLink(jobs.get(invoiceId) ?? null, work),
+    // The Linked card: each connected system, and this invoice's link there.
+    linksTo: linkedSystems(work, accounting),
     versions: versions.map(({ version, issuedAt, issuedBy }) => ({ version, issuedAt, issuedBy })),
   };
 }
@@ -343,6 +361,7 @@ export function createInvoicingRouter({
       return { rows, jobs: await jobsByInvoice(db, organisationId, rows.map((r) => r.invoice.id)) };
     })();
     const [views, counted, { rows, jobs }, mode] = await Promise.all([checking, counting, listing, sendMode]);
+    const systems = work();
     const counts = Object.fromEntries(INVOICE_STATUSES.map((s) => [s, 0]));
     for (const { status: s, n } of counted) counts[s] = n;
     counts.to_check = views.toCheck.length;
@@ -355,7 +374,7 @@ export function createInvoicingRouter({
       invoices: rows.map(({ invoice, contactName }) => ({
         ...invoice,
         contactName,
-        job: jobs.get(invoice.id) ?? null,
+        job: withLink(jobs.get(invoice.id) ?? null, systems),
         view: views.problems.has(invoice.id) ? 'problem' : ready.has(invoice.id) ? 'ready' : toCheck.has(invoice.id) ? 'to_check'
           : views.sending.has(invoice.id) ? 'sending' : null,
         problems: views.problems.get(invoice.id) ?? [],
@@ -363,6 +382,8 @@ export function createInvoicingRouter({
       counts,
       sendsTo: system?.name ?? null,
       sendMode: mode,
+      // The Linked column: one icon for each connected system.
+      linksTo: linkedSystems(systems, system),
     });
   }));
 

package/server/auth/clerk.js

@@ -8,6 +8,9 @@ import { normaliseEmail } from './people.js';
 //   getUser(clerkUserId)     the Clerk user (emails, external accounts)
 //   findUserIdByEmail(email) the Clerk user with this email, or null
 //   createUser({ email })    a Clerk account with no password, for an invitee
+//   deleteUser(clerkUserId)  removes a Clerk account (an unused invitee's only)
+//   inviteByEmail({ email, redirectUrl })
+//                            Clerk emails an invitation link to `email`
 //
 // The real one is loaded only when FLOW_AUTH=clerk.
 export async function loadClerkAdapter({ secretKey, publishableKey, proxyUrl, authorizedParties = [] }) {
@@ -36,9 +39,41 @@ export async function loadClerkAdapter({ secretKey, publishableKey, proxyUrl, au
       const user = await client.users.createUser({ emailAddress: [email], skipPasswordRequirement: true });
       return user.id;
     },
+    async deleteUser(clerkUserId) {
+      await client.users.deleteUser(clerkUserId);
+    },
+    // Clerk sends the email. Its link opens `redirectUrl` with a sign-up
+    // ticket; a pending invitation for the same address is replaced.
+    async inviteByEmail({ email, redirectUrl }) {
+      await client.invitations.createInvitation({ emailAddress: email, redirectUrl, notify: true, ignoreExisting: true });
+    },
   };
 }
 
+// A Clerk account nobody has used: never signed in, no password and no
+// connected account. Flow made it for an invitee (ensureClerkAccount).
+export function unusedClerkAccount(clerkUser) {
+  return Boolean(clerkUser)
+    && !clerkUser.lastSignInAt
+    && clerkUser.passwordEnabled === false
+    && !(Array.isArray(clerkUser.externalAccounts) && clerkUser.externalAccounts.length);
+}
+
+// Has Clerk email an invitation to `email`. Clerk does not invite an address
+// that already has an account, so an unused account Flow made earlier is
+// removed first; the invitee's account is made when they take up the
+// invitation. An address with a used account gets no email: that person can
+// already sign in. Returns { emailed }.
+export async function sendClerkInvitation(clerk, email, redirectUrl) {
+  const existing = await clerk.findUserIdByEmail(email);
+  if (existing) {
+    if (!unusedClerkAccount(await clerk.getUser(existing))) return { emailed: false };
+    await clerk.deleteUser(existing);
+  }
+  await clerk.inviteByEmail({ email, redirectUrl });
+  return { emailed: true };
+}
+
 // An invitee needs a Clerk account before their first sign-in, because with
 // public sign-up off Flow's sign-in page never creates one. The account has
 // the invitee's email (verified, since the backend made it) and no password;

package/server/auth/routes.js

@@ -1,9 +1,10 @@
 import express from 'express';
 import { FlowError } from '../core/errors.js';
 import { rateLimit } from '../rate-limit.js';
-import { ensureClerkAccount } from './clerk.js';
+import { ensureClerkAccount, sendClerkInvitation } from './clerk.js';
 import {
   findPersonByEmail,
+  findPersonById,
   invitePerson,
   listPeople,
   normaliseEmail,
@@ -139,23 +140,61 @@ export function createSignInRouter({ settings, db, clerk, personAuth, defaultFam
     }
   });
 
-  // Invite someone. Flow also makes sure they have a Clerk account, because
-  // with public sign-up off the sign-in page never creates one.
+  // The invitation email's link opens this installation's sign-in page.
+  const signInUrl = (req) => `${req.protocol}://${req.get('host')}/sign-in`;
+
+  // Clerk emails the invitation. If Clerk cannot, Flow makes the invitee's
+  // Clerk account itself (with public sign-up off the sign-in page never
+  // creates one) and the owner sends the sign-in message by hand.
+  async function inviteWithClerk(req, email) {
+    try {
+      return await sendClerkInvitation(clerk, email, signInUrl(req));
+    } catch (error) {
+      log.error?.(`[people] Clerk invitation email failed: ${error.message}`);
+    }
+    await ensureClerkAccount(clerk, email);
+    return { emailed: false };
+  }
+
+  // Invite someone.
   people.post('/', async (req, res) => {
     try {
       const email = normaliseEmail(req.body?.email);
       const role = req.body?.role;
       if (!isPlainEmail(email)) throw new FlowError('invalid', 'email must be a plain (ASCII) email address');
       if (await findPersonByEmail(db, email)) throw new FlowError('conflict', 'that email address is already on the people list');
+      let invite;
       try {
-        await ensureClerkAccount(clerk, email);
+        invite = await inviteWithClerk(req, email);
       } catch (error) {
         log.error?.(`[people] Clerk account for an invitation failed: ${error.message}`);
         return res.status(503).json({ ok: false, code: 'sign_in_unavailable', error: 'Flow could not prepare the sign-in account. Try again shortly.' });
       }
       const person = await invitePerson(db, { email, name: req.body?.name ?? null, role, invitedBy: req.person.id });
-      log.info?.(`[people] ${req.person.id} invited ${person.id} as ${person.role}`);
-      res.status(201).json({ ok: true, person: publicPerson(person) });
+      log.info?.(`[people] ${req.person.id} invited ${person.id} as ${person.role} (${invite.emailed ? 'emailed' : 'not emailed'})`);
+      res.status(201).json({ ok: true, person: publicPerson(person), invite });
+    } catch (error) {
+      sendError(res, error, log);
+    }
+  });
+
+  // Email an invited person's invitation again. Only for someone who has
+  // not signed in yet.
+  people.post('/:id/invite', async (req, res) => {
+    try {
+      const person = await findPersonById(db, req.params.id);
+      if (!person) throw new FlowError('not_found', 'person not found');
+      if (person.clerkUserId || person.status !== 'active') throw new FlowError('conflict', 'only an invited person who has not signed in yet gets an invitation email');
+      let invite;
+      try {
+        invite = await sendClerkInvitation(clerk, person.email, signInUrl(req));
+      } catch (error) {
+        log.error?.(`[people] Clerk invitation email failed: ${error.message}`);
+        return res.status(503).json({ ok: false, code: 'sign_in_unavailable', error: 'Clerk could not send the invitation email. Try again shortly.' });
+      }
+      if (!invite.emailed) throw new FlowError('conflict', 'they already have a sign-in account: they can sign in now');
+      log.info?.(`[people] ${req.person.id} emailed the invitation for ${person.id} again`);
+      res.json({ ok: true, invite });
     } catch (error) {
       sendError(res, error, log);
     }

package/server/core/host.js

@@ -0,0 +1,24 @@
+// Where this copy of Flow runs. A Replit workspace (the editor's Run button)
+// shares its secrets with the published app, so without a rule it would sync,
+// draft and send next to the live copy: twice the calls to Xero and Seazona,
+// and a second sender. FLOW_BACKGROUND_JOBS decides; unset, it is off in a
+// Replit workspace and on everywhere else (docs/SELF_HOSTING.md).
+
+const read = (env, name) => String(env?.[name] ?? '').trim();
+
+// Replit sets REPL_ID in the workspace and REPLIT_DEPLOYMENT on the published
+// app only.
+export function isReplitWorkspace(env = process.env) {
+  return Boolean(read(env, 'REPL_ID')) && !read(env, 'REPLIT_DEPLOYMENT');
+}
+
+// Whether this copy runs the jobs that call or write to other systems: the
+// Seazona sync, the Xero read, the pipeline, the daily reconcile and the send
+// worker. Off, it also never writes to Xero.
+export function backgroundJobsOn(env = process.env) {
+  const value = read(env, 'FLOW_BACKGROUND_JOBS').toLowerCase();
+  if (value === 'on') return true;
+  if (value === 'off') return false;
+  if (value) throw new Error('FLOW_BACKGROUND_JOBS must be "on", "off" or unset');
+  return !isReplitWorkspace(env);
+}

package/server/index.js

@@ -13,6 +13,7 @@ import { createMonitoredLog } from './core/monitoring.js';
 import { createTracing, traceQueries } from './core/tracing.js';
 import { createPipelineWorker } from './core/pipeline.js';
 import { createReconcileWorker } from './core/reconcile.js';
+import { backgroundJobsOn } from './core/host.js';
 import { createSendWorker } from './core/sending.js';
 import { resolveSecretsKey } from './core/secrets.js';
 import { adapters as shippedAdapters } from './integrations/adapters.js';
@@ -96,20 +97,25 @@ try {
 const integrationsOn = integrations.list().filter((a) => a.enabled).map((a) => `${a.id}${a.state === 'ready' ? '' : ` (${a.state})`}`);
 console.log(`[integrations] on: ${integrationsOn.join(', ') || 'none'}; secrets key ${secrets ? `from ${secrets.source}` : 'not set (FLOW_SECRETS_KEY)'}`);
 
+// Background jobs run only where FLOW_BACKGROUND_JOBS allows: never in a
+// Replit workspace, which shares the published app's secrets
+// (server/core/host.js).
+const jobsOn = backgroundJobsOn(process.env);
+if (!jobsOn) console.log('[flow] background jobs off (FLOW_BACKGROUND_JOBS): no sync, pipeline, reconcile or sending in this copy');
 // The pipeline (server/core/pipeline.js) joins what the integrations copy into
 // Flow: jobs into the ledger, and each job to its accounting invoice. It runs
 // only while an integration that feeds it is on, and writes to no other
 // system. FLOW_PIPELINE=off stops it.
-if (process.env.FLOW_PIPELINE !== 'off') {
+if (jobsOn && process.env.FLOW_PIPELINE !== 'off') {
   createPipelineWorker({ db: database.db, integrations, log }).start();
 }
 // The daily reconcile (server/core/reconcile.js) compares Flow's own copies
 // and opens a review item for a day that does not agree. It never calls or
 // writes to another system.
-createReconcileWorker({ db: database.db, integrations, log }).start();
+if (jobsOn) createReconcileWorker({ db: database.db, integrations, log }).start();
 // The send worker (server/core/sending.js) sends only what a person queued
 // with Send all ready, to the accounting integration that is on.
-createSendWorker({ db: database.db, integrations, log }).start();
+if (jobsOn) createSendWorker({ db: database.db, integrations, log }).start();
 
 let auth = null;
 if (settings.mode === 'clerk') {

package/server/integrations/seazona/index.js

@@ -111,7 +111,7 @@ export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.
       const scheduler = settings.scheduled ? createSeazonaScheduler({ db, settings, run, now, log, timers }) : null;
       runtime = { settings, db, client, run, scheduler };
       scheduler?.start();
-      log.info?.(`[seazona] mode ${settings.mode}; background sync ${scheduler ? 'on' : 'off (live mode only)'}; ${settings.rate.requestsPerMinute} requests a minute at most`);
+      log.info?.(`[seazona] mode ${settings.mode}; background sync ${scheduler ? 'on' : settings.mode === 'live' ? 'off (FLOW_BACKGROUND_JOBS)' : 'off (live mode only)'}; ${settings.rate.requestsPerMinute} requests a minute at most`);
     },
 
     async stop() {

package/server/integrations/seazona/settings.js

@@ -8,6 +8,8 @@
 //   replay   recorded, synthetic responses from a file; no network at all.
 // There is no default mode. Without one the adapter does nothing.
 
+import { backgroundJobsOn } from '../../core/host.js';
+
 export const MODES = Object.freeze(['live', 'sandbox', 'replay']);
 
 // Seazona publishes 60 requests a minute per API client. Flow stays at half of
@@ -190,8 +192,9 @@ export function resolveSeazonaSettings(env = process.env) {
     credentials: null,
     replayFile: '',
     rate,
-    // The scheduler starts only in live mode (issue #10).
-    scheduled: mode === 'live',
+    // The scheduler starts only in live mode (issue #10), and only where
+    // background jobs run: never in a Replit workspace (server/core/host.js).
+    scheduled: mode === 'live' && backgroundJobsOn(env),
     // The address of one order in Seazona's own screens, with {ref} for the
     // order number, for "Open in Seazona" on a stage move. Optional; one
     // without {ref} is ignored.

package/server/integrations/sentry/index.js

@@ -1,4 +1,5 @@
 import * as SentryNode from '@sentry/node';
+import { isReplitWorkspace } from '../../core/host.js';
 import { scrubSpan } from '../../ui/monitoring.js';
 
 // The Sentry adapter (docs/SENTRY.md). It sends the errors Flow logs, the
@@ -40,7 +41,7 @@ export const SENTRY_SETUP = {
   },
   fields: [
     { name: 'SENTRY_DSN', label: 'DSN', kind: 'url', help: 'From the Sentry project\'s Client Keys. Browsers see it, so it is not a secret.' },
-    { name: 'SENTRY_ENVIRONMENT', label: 'Environment', help: 'How Sentry labels this installation, for example production. Empty: production.' },
+    { name: 'SENTRY_ENVIRONMENT', label: 'Environment', help: 'How Sentry labels this installation, for example production. Empty: production, or workspace in a Replit workspace.' },
     { name: 'SENTRY_FEEDBACK', label: 'Report a problem button', kind: 'onoff', help: 'On: everyone signed in can send a report, with a screenshot, to this Sentry project.' },
     { name: 'SENTRY_TRACES_SAMPLE_RATE', label: 'Traces', help: 'The share of clicks, page loads and requests timed, from 0 (off) to 1 (all). Empty: 0.2.' },
   ],
@@ -50,7 +51,9 @@ export function readSentrySettings(env) {
   const dsn = String(env.SENTRY_DSN ?? '').trim();
   if (!dsn) throw new Error('SENTRY_DSN is not set. Enter the Sentry project\'s DSN in Settings, Integrations.');
   if (!DSN_PATTERN.test(dsn)) throw new Error('SENTRY_DSN is not a Sentry DSN (https://<key>@<host>/<project id>).');
-  const environment = String(env.SENTRY_ENVIRONMENT ?? '').trim() || 'production';
+  // A Replit workspace shares the published app's secrets; its errors are
+  // labelled apart so they never read as the live app's.
+  const environment = String(env.SENTRY_ENVIRONMENT ?? '').trim() || (isReplitWorkspace(env) ? 'workspace' : 'production');
   const feedback = String(env.SENTRY_FEEDBACK ?? 'on').trim() !== 'off';
   const rate = String(env.SENTRY_TRACES_SAMPLE_RATE ?? '').trim();
   const tracesSampleRate = rate === '' ? DEFAULT_TRACES_SAMPLE_RATE : Number(rate);