beehaven 0.8.33 → 0.8.34

package/dist/agent-attribution.js

@@ -62,6 +62,21 @@ export const BOOTSTRAP_ACTIONS = new Set([
     // The workspace-scoped predecessors, kept so an older flow still bootstraps.
     'agent-mint-token', 'agent-create', 'agent-list',
 ]);
+/**
+ * ⚠⚠ SPT-13 — `agent-create` ESTABLISHES AN IDENTITY ONLY WHEN IT CREATES THE ONE SIGNED IN.
+ *
+ * Unwrapped, it runs as the account owner. That is right for the bootstrap it exists for — the
+ * signed-in agent creating ITSELF in a workspace that has no row for it yet. It was wrong for every
+ * other agent: a signed-in agent whose matrix says `agents.create = false` minted `ss41-probe`
+ * because the call left as its owner. Creating ANOTHER agent is ordinary work, so it is wrapped and
+ * the capability gate decides.
+ */
+function createsAnotherAgent(action, input, active) {
+    if (action !== 'agent-create' || !active || active.expired)
+        return false;
+    // Without an `id` the server mints a random one, so the new agent cannot be the signed-in one.
+    return String(input?.id ?? '').trim() !== active.agentId;
+}
 /**
  * ⚠⚠ ACTIONS THE DAEMON ANSWERS ITSELF — THEY NEVER REACH A WORKSPACE, SO THEY CANNOT BE WRAPPED.
  *
@@ -165,7 +180,7 @@ export function alreadyAttributed(action, input) {
 export function activeAgentWrap(action, input, values) {
     if (alreadyAttributed(action, input))
         return { action, input };
-    if (BOOTSTRAP_ACTIONS.has(action) || DAEMON_LOCAL_ACTIONS.has(action))
+    if (DAEMON_LOCAL_ACTIONS.has(action))
         return { action, input };
     let active = null;
     try {
@@ -174,6 +189,8 @@ export function activeAgentWrap(action, input, values) {
     catch {
         return { action, input };
     }
+    if (BOOTSTRAP_ACTIONS.has(action) && !createsAnotherAgent(action, input, active))
+        return { action, input };
     if (!active || active.expired)
         return { action, input };
     return {
@@ -182,7 +199,8 @@ export function activeAgentWrap(action, input, values) {
             agentId: active.agentId,
             action,
             input,
-            ...(active.record.sessionId ? { sessionId: active.record.sessionId } : {}),
+            // This session's own work session (AWO-394), not the record every terminal shares.
+            ...(active.sessionId ? { sessionId: active.sessionId } : {}),
             // ⚠ WHICH DOOR — `cli:call` vs `cli:ticket` vs … See `cliDoor()` and
             // `agent_activity.source`. Set here, at the ONE wrap every CLI path shares, so a new
             // verb is labelled without its author having to know this exists.

package/dist/agent-scope.js

@@ -29,9 +29,43 @@
  * `cd` is recorded.
  */
 export function deriveAgentScope(env = process.env) {
+    /**
+     * ⚠⚠ A HARNESS SESSION ID OUTRANKS `BEEHAVEN_AGENT` (AWO-394). The env var names WHO — and
+     * `activeAgentName` still reads it first for that — but it is not a per-session handle: the
+     * daemon spawns every desktop Claude session with `BEEHAVEN_AGENT=<desktop principal>`, so they
+     * all derived ONE scope and shared one cursor and one work session. The session id is what
+     * tells two conversations of one agent apart.
+     */
+    const harness = harnessScope(env);
+    if (harness && harness !== 'claude')
+        return harness;
     const explicit = (env.BEEHAVEN_AGENT || '').trim();
     if (explicit)
-        return explicit; // an explicit choice always wins
+        return explicit; // an explicit choice, absent a session id
+    if (harness)
+        return harness;
+    /**
+     * ⚠ NO MARKER AND NO TTY IS STILL NOT A PERSON. Key on the PARENT pid — stable for the
+     * life of one process tree, different for a concurrent one. Not perfect (pids are reused
+     * eventually), but the failure mode of a collision here is two runs of the SAME tool,
+     * which is far milder than the shared-file failure it replaces: two DIFFERENT agents.
+     */
+    if (!process.stdin.isTTY && !process.stdout.isTTY)
+        return `pid-${process.ppid}`;
+    /**
+     * ⚠ A TERMINAL TAB IS ITS OWN SCOPE WHEN THE TERMINAL SAYS WHICH TAB (AWO-394). Every human
+     * terminal used to derive `''`, so one `agent login` in any tab made EVERY tab that agent — and
+     * the login's own advice ("other terminals: export BEEHAVEN_AGENT") was moot. These ids are set
+     * per tab/pane by the terminal itself. Without one, `''` keeps the old shared behaviour.
+     *
+     * ⚠ A HUMAN WHO HAS NOT LOGGED IN AS AN AGENT STILL SHARES `target.json` — `cli-state`
+     * maps an unbound `term-*` scope back to the shared cursor, so nobody's `cd` moves.
+     */
+    const tab = terminalTabId(env);
+    return tab ? `term-${tab}` : ''; // a human at a terminal
+}
+/** The harness session scope (`claude-…`, `codex-…`, `gemini-…`), or '' — see `deriveAgentScope`. */
+function harnessScope(env) {
     // Claude Code — its own marker (`daemon-omni.ts` already relies on it: "the SDK refuses to
     // start when CLAUDECODE=1 is set … it's how it refuses to recurse"), plus a per-session id.
     if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT) {
@@ -45,15 +79,26 @@ export function deriveAgentScope(env = process.env) {
     if (env.GEMINI_CLI_SESSION_ID) {
         return `gemini-${String(env.GEMINI_CLI_SESSION_ID).replace(/[^A-Za-z0-9]/g, '').slice(0, 12)}`;
     }
-    /**
-     * ⚠ NO MARKER AND NO TTY IS STILL NOT A PERSON. Key on the PARENT pid — stable for the
-     * life of one process tree, different for a concurrent one. Not perfect (pids are reused
-     * eventually), but the failure mode of a collision here is two runs of the SAME tool,
-     * which is far milder than the shared-file failure it replaces: two DIFFERENT agents.
-     */
-    if (!process.stdin.isTTY && !process.stdout.isTTY)
-        return `pid-${process.ppid}`;
-    return ''; // a human at a terminal
+    return '';
+}
+/**
+ * Which terminal tab or pane this is, from the id the terminal itself exports — or ''.
+ * macOS Terminal / iTerm2 (`TERM_SESSION_ID`, `ITERM_SESSION_ID`), Windows Terminal, tmux, kitty,
+ * WezTerm. Hashed to a short token: some carry paths or GUIDs, and it lands in a filename.
+ */
+export function terminalTabId(env = process.env) {
+    const raw = env.TMUX_PANE && env.TMUX ? `tmux${env.TMUX}${env.TMUX_PANE}`
+        : env.ITERM_SESSION_ID || env.TERM_SESSION_ID || env.WT_SESSION
+            || (env.KITTY_WINDOW_ID ? `kitty${env.KITTY_WINDOW_ID}` : '')
+            || (env.WEZTERM_PANE ? `wezterm${env.WEZTERM_PANE}` : '');
+    if (!raw)
+        return '';
+    let h = 2166136261; // FNV-1a — stable, dependency-free
+    for (let i = 0; i < raw.length; i++) {
+        h ^= raw.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return (h >>> 0).toString(36);
 }
 export function principalKind(input) {
     const now = input.now ?? Date.now();

package/dist/agent-state.js

@@ -11,6 +11,7 @@
  * (`agent:mint`) and the CLI just stores the resulting record.
  */
 import { deriveAgentScope } from './agent-scope.js';
+import { readSessionBinding } from './session-binding.js';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync, renameSync, chmodSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -230,6 +231,17 @@ export function bindAgentScope(name, scope, opts = {}) {
     }
     catch { /* binding is a convenience; a failed write must not fail the login */ }
 }
+/** Forget that `scope` was logged in as `name` — `agent logout` in that session (AWO-394). */
+export function unbindAgentScope(name, scope) {
+    try {
+        const rec = loadAgent(name);
+        const prev = Array.isArray(rec?.boundScopes) ? rec.boundScopes : [];
+        if (!rec || !prev.includes(scope))
+            return;
+        saveAgent(name, { ...rec, boundScopes: prev.filter((s) => s !== scope) });
+    }
+    catch { /* best-effort */ }
+}
 /**
  * The stable half of a process scope — the TOOL rather than the conversation.
  *
@@ -240,6 +252,9 @@ export function bindAgentScope(name, scope, opts = {}) {
 export function scopeFamilyKey(scope) {
     if (!scope)
         return 'family:terminal';
+    // A terminal TAB (AWO-394) inherits nothing: one tab's login must not become another tab's identity.
+    if (scope.startsWith('term-'))
+        return null;
     const m = /^(claude|codex|gemini)-/.exec(scope);
     if (m)
         return `family:${m[1]}`;
@@ -254,6 +269,14 @@ export function scopeFamilyKey(scope) {
  */
 export function agentForScope(scope = '') {
     try {
+        /**
+         * ⚠ THE SESSION BINDING WINS (AWO-394). `agent login` writes `sessions/<scope>.json`, and that
+         * exact record — not a list on a record shared by every terminal using the name — is what this
+         * session is. `boundScopes` below stays for sessions bound before it existed and for the family.
+         */
+        const session = scope ? readSessionBinding(scope) : null;
+        if (session && loadAgent(session.agent))
+            return session.agent;
         const all = listAgents();
         const boundTo = (key) => all
             .filter(({ record }) => Array.isArray(record.boundScopes)
@@ -369,6 +392,18 @@ export function activeAgentName(values) {
         return null;
     }
 }
+/** The session binding of THIS process, when it belongs to `name` (or to whoever is active). */
+export function activeSessionBinding(name) {
+    try {
+        const b = readSessionBinding(deriveAgentScope());
+        if (!b)
+            return null;
+        return !name || b.agent === name ? b : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Resolve the active agent identity for this invocation, or null when no
  * agent is selected. Used by the call path to attach the token + route the
@@ -381,6 +416,13 @@ export function resolveActiveAgent(values) {
     const record = loadAgent(name);
     if (!record)
         return null;
+    const session = activeSessionBinding(name);
+    /**
+     * ⚠ THE SESSION'S OWN WORK SESSION, NOT THE SHARED RECORD'S (AWO-394). `record.sessionId` is one
+     * field for every terminal using this name, so a second terminal's login replaced the first's and
+     * both then wrote under it. A session bound by `agent login` carries its own.
+     */
+    const sessionId = session ? session.sessionId : record.sessionId;
     return {
         name,
         token: record.token,
@@ -389,6 +431,8 @@ export function resolveActiveAgent(values) {
         avatarId: record.avatarId,
         record,
         expired: typeof record.expiresAt === 'number' && record.expiresAt <= Date.now(),
+        ...(sessionId ? { sessionId } : {}),
+        ...(session ? { session } : {}),
     };
 }
 /**

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = '8f7eef9e12ce';
+export const BUILD_SHA = '0fc3f190acdb';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-15T07:24Z';
+export const BUILD_TIME = '2026-10-27T20:29Z';
 /**
  * The build identity as one short string, for `--version`.
  *

package/dist/cli-state.js

@@ -41,7 +41,8 @@
  * target is what stops the inheritance. Pin it, or pass `--building` per call.
  */
 import { deriveAgentScope } from './agent-scope.js';
-import { agentForScope } from './agent-state.js';
+import { agentForScope, loadAgent } from './agent-state.js';
+import { readSessionBinding, scopeKey } from './session-binding.js';
 import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, renameSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
@@ -92,14 +93,55 @@ export function effectiveScope() {
     const raw = deriveAgentScope();
     if (!raw)
         return ''; // a human — the shared file
+    /**
+     * ⚠⚠ A SESSION BOUND BY `agent login` HAS ITS OWN CURSOR (AWO-394) — keyed on the session, not
+     * the agent name. Keyed on the name, two terminals logged in as one agent shared a workspace:
+     * one `connect` moved both. The workspace a NEW session starts in is chosen at login (the
+     * identity's last workspace, or `--workspace`), which keeps what the name key was for.
+     */
+    if (readSessionBinding(raw))
+        return raw;
     try {
+        // A session bound before session bindings existed keeps its agent-keyed cursor until it logs in again.
         const bound = agentForScope(raw);
-        if (bound)
-            return bound;
+        if (bound && !raw.startsWith('term-')) {
+            // …but only an EXACT binding. A session that merely inherited the family's identity starts
+            // at home in its own cursor — it must not inherit someone else's workspace with the name.
+            const rec = loadAgent(bound);
+            if (Array.isArray(rec?.boundScopes) && rec.boundScopes.includes(raw))
+                return bound;
+        }
     }
     catch { /* no agents dir, or a bad record — fall back to the process scope */ }
+    // A terminal tab nobody logged in from is the human: the shared cursor, exactly as before.
+    if (raw.startsWith('term-'))
+        return '';
     return raw;
 }
+/** The cursor file of a given session scope — `agent login` seeds a NEW session's cursor here. */
+export function writeTargetForScope(scope, address, kind) {
+    const key = scopeKey(scope);
+    if (!key)
+        return;
+    ensureStateDir();
+    const file = join(STATE_DIR, `target-${key}.json`);
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify({ address, connectedAt: Date.now(), kind: kind ?? inferKind(address) }, null, 2), { mode: 0o600 });
+    renameSync(tmp, file);
+}
+/** Read the cursor of a given scope without making it this process's (the legacy agent-keyed file). */
+export function readTargetForKey(key) {
+    try {
+        const safe = scopeKey(key);
+        if (!safe)
+            return null;
+        const parsed = JSON.parse(readFileSync(join(STATE_DIR, `target-${safe}.json`), 'utf-8'));
+        return typeof parsed?.address === 'string' && parsed.address ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 function targetFileFor(agent = effectiveScope()) {
     const safe = (agent || '').trim().replace(/[^A-Za-z0-9_-]/g, '');
     return join(STATE_DIR, safe ? `target-${safe}.json` : 'target.json');

package/dist/cli.js

@@ -849,48 +849,9 @@ async function printStatus() {
  * One function, because four hand-written copies is how one missing `else` became four.
  */
 async function resolveTargetBuilding(values) {
-    if (values.building)
-        return; // an explicit flag always wins
-    const { getTarget, isHomeAddress } = await import('./cli-state.js');
-    const t = getTarget();
-    if (t?.address?.includes('/')) {
-        const [bType, ...bIdParts] = t.address.split('/');
-        values.building = `${bType}:${bIdParts.join('/')}`;
-        return;
-    }
-    if (t && isHomeAddress(t.address)) {
-        /**
-         * ⚠ HOME IS A POSITIVE STATEMENT, NOT AN ABSENCE. The daemon's focus is a routing
-         * optimisation; the file is where the user said to be. If they disagree the daemon is
-         * stale — drop it, so the call lands where `pwd` says it will, and SAY so.
-         */
-        try {
-            const { daemonGetConnection, daemonDisconnect } = await import('./daemon-client.js');
-            const conn = await daemonGetConnection();
-            if (conn?.buildingId) {
-                await daemonDisconnect();
-                console.error(`\x1b[2m  (dropped a stale daemon focus on ${conn.buildingType}/${conn.buildingId}`
-                    + ` — your target is home)\x1b[0m`);
-            }
-        }
-        catch { /* no daemon, or it refused — home is the default route anyway */ }
-        return;
-    }
-    if (!t) {
-        /**
-         * ⚠ NO TARGET EVER SET — inherit the daemon's connection. The machine-global fallback
-         * `cli-state.ts` warns about: another room, the Mac app or a human's terminal can set
-         * it, so an agent that never runs `connect` inherits someone else's cursor. Kept for
-         * back-compat; `connect home` is what opts out, and this fix makes that opt-out real.
-         */
-        try {
-            const { daemonGetConnection } = await import('./daemon-client.js');
-            const conn = await daemonGetConnection();
-            if (conn)
-                values.building = `${conn.buildingType}:${conn.buildingId}`;
-        }
-        catch { /* fall through to home */ }
-    }
+    // ⚠ ONE resolver for every verb, typed or raw (AWO-393/394) — see session-target.ts.
+    const { resolveTargetBuilding: resolve } = await import('./session-target.js');
+    await resolve(values);
 }
 /**
  * ⚠⚠ AN IDENTIFIABLE AGENT MUST LOG IN BEFORE IT ACTS.
@@ -1103,8 +1064,10 @@ async function requireAgentSession(command, values) {
         cfg = {};
     }
     // ⚠ ONE DECISION, EXECUTED BY A GUARD (`principalKind`). This branch does nothing but act on it.
+    const { activeSessionBinding: sessionForGate } = await import('./agent-state.js');
     const who = principalKind({
-        agentSessionId: rec?.sessionId,
+        // This session's own work session first (AWO-394); the shared record's for sessions bound before it.
+        agentSessionId: sessionForGate(name)?.sessionId ?? rec?.sessionId,
         agentExpiresAt: rec?.expiresAt,
         agentRuntime: isAgentRuntime(),
         accountUserId: cfg.userId,
@@ -2237,6 +2200,14 @@ async function run() {
             // workspace via daemonRpc('shell:exec', …) — see
             // commands/shell.ts:resolveDefaultBuilding + execRemote.
             const { HOME_ADDRESSES: HOME_ADDRS, CANONICAL_HOME_ADDRESS } = await import('./cli-state.js');
+            /**
+             * ⚠⚠ A SIGNED-IN SESSION MOVES ONLY ITSELF (AWO-394). The daemon's focus is ONE variable for
+             * the machine, so `connect` used to re-point every other terminal that had no cursor of its
+             * own — agent A connecting to a Shopify store moved agent B. A session's own cursor file is
+             * the whole of its routing; the daemon is not told.
+             */
+            const { activeSessionBinding: sessionOf } = await import('./agent-state.js');
+            const ownSession = sessionOf();
             if (HOME_ADDRS.has(target)) {
                 const { setTarget } = await import('./cli-state.js');
                 // Canonical label is 'workspace' (no "home DO" — the daemon's relay is to the
@@ -2247,7 +2218,11 @@ async function run() {
                 setTarget(CANONICAL_HOME_ADDRESS, 'cloud');
                 // Best-effort daemon-side cleanup of any prior connect()
                 // focus — we want home to be the default routing target.
-                if (daemonUp) {
+                if (ownSession) {
+                    const { moveAgentSession } = await import('./commands/agent.js');
+                    await moveAgentSession(CANONICAL_HOME_ADDRESS);
+                }
+                else if (daemonUp) {
                     try {
                         await daemonDisconnect();
                     }
@@ -2290,6 +2265,15 @@ async function run() {
                 // where we meant to be, and we can retry without a re-`cd`.
                 const { setTarget } = await import('./cli-state.js');
                 setTarget(`${bType}/${bId}`, 'cloud');
+                if (ownSession) {
+                    const { moveAgentSession } = await import('./commands/agent.js');
+                    await moveAgentSession(`${bType}/${bId}`);
+                    if (bType === 'shopifyStore' || bType === 'store') {
+                        console.log(color.dim(`  Store DOs take operator calls through: beehaven admin do ${bType}/${bId} <action> '<json>'  (platform admins)`));
+                    }
+                    console.log(`  ${color.green('✓')} This session → ${color.green(`${bType}/${bId}`)}`);
+                    break;
+                }
                 try {
                     await daemonConnect(bType, bId);
                 }
@@ -2399,7 +2383,13 @@ async function run() {
             const { clearTarget: clearDisconn } = await import('./cli-state.js');
             clearDisconn();
             const { isDaemonRunning: isDaemonRunningDisc, daemonDisconnect: daemonDisconnectDisc } = await import('./daemon-client.js');
-            if (await isDaemonRunningDisc()) {
+            const { activeSessionBinding: sessionOfDisc } = await import('./agent-state.js');
+            if (sessionOfDisc()) {
+                // AWO-394 — a signed-in session goes home alone; the machine-wide focus is someone else's.
+                const { moveAgentSession } = await import('./commands/agent.js');
+                await moveAgentSession('workspace');
+            }
+            else if (await isDaemonRunningDisc()) {
                 try {
                     await daemonDisconnectDisc();
                 }
@@ -2457,7 +2447,22 @@ async function run() {
                     // ⚠ `values` HERE TOO — `beehaven status --agent alice` must report who that call would
                     //   run as, not who the shell happens to be bound to. See `requireAgentSession`.
                     const who = activeAgentName(values);
-                    if (who && eff === who) {
+                    const { activeSessionBinding } = await import('./agent-state.js');
+                    const { describeAddress, currentEnvName } = await import('./session-binding.js');
+                    const bound = activeSessionBinding(who);
+                    if (who && bound) {
+                        // AWO-394 — one session: identity + workspace + env, owned by this scope.
+                        const { loadAgent } = await import('./agent-state.js');
+                        const r = loadAgent(who);
+                        const gone = typeof r?.expiresAt === 'number' && r.expiresAt <= Date.now();
+                        const envNow = currentEnvName();
+                        console.log(gone
+                            ? `  Agent:  ${color.green(who)}  ${'\x1b[31m'}TOKEN EXPIRED\x1b[0m${color.dim(' — calls are refused until `beehaven agent login ' + who + '`')}`
+                            : `  Agent:  ${color.green(who)}${color.dim('  (this session — every call here runs as this agent)')}`);
+                        console.log(`  Session: ${color.green(bound.scope)}${color.dim(`  work session ${bound.sessionId ? bound.sessionId.slice(0, 8) : 'none'} · in ${describeAddress(bound.workspace)}`)}`);
+                        console.log(`  Env:    ${bound.env === envNow ? color.green(bound.env) : `\x1b[31m${bound.env} — daemon is on ${envNow}; calls are refused\x1b[0m`}`);
+                    }
+                    else if (who && eff === who) {
                         // Identity, workspace session and cursor are one handle.
                         const { loadAgent } = await import('./agent-state.js');
                         const r = loadAgent(who);
@@ -2472,6 +2477,11 @@ async function run() {
                             : `  Agent:  ${color.green(who)}${color.dim('  (logged in — calls run as this agent)')}`);
                         console.log(`  Scope:  ${color.green(eff)}${color.dim('  (cursor follows the agent, not the session)')}`);
                     }
+                    else if (raw.startsWith('term-')) {
+                        // AWO-394 — a tab nobody signed in from is the person, on the shared cursor.
+                        console.log(`  Scope:  ${color.green(raw)}${color.dim('  (this tab — `beehaven agent login <name>` here signs in THIS tab only)')}`);
+                        console.log(`  Agent:  ${color.dim('none — calls run as you, on the cursor your other terminals share')}`);
+                    }
                     else if (raw) {
                         console.log(`  Scope:  ${color.green(raw)}${color.dim('  (private cursor — concurrent agents cannot clobber it)')}`);
                         console.log(`  Agent:  ${color.dim('none — calls run as you. `beehaven agent login <name>` to act as an agent')}`);

package/dist/commands/agent-skills.js

@@ -236,14 +236,25 @@ export function installAgentSkills() {
                  * ⚠ NO STAMP ⇒ TREATED AS UNTOUCHED. Every skill installed before stamping existed has
                  * none, and assuming an edit there would freeze them permanently — updates would silently
                  * stop landing, which is the failure mode this whole change exists to remove.
+                 *
+                 * ⚠ IDENTICAL TO WHAT SHIPS ⇒ CURRENT, WHATEVER THE STAMP SAYS (PPO-476). The Mac app writes
+                 * these same files on every launch, and a copy can only equal the release by coming from
+                 * it. Asked first, a stale stamp called every skill "edited locally" and none was ever
+                 * re-stamped, so the next real update never landed either.
                  */
                 if (existing) {
+                    const local = localSha(destDir, skillFiles);
+                    if (entry?.sha && local === entry.sha) {
+                        stamp(destDir, skillFiles, warnings);
+                        steps.push(`${agent}/${name}=current`);
+                        continue;
+                    }
                     let stamped = '';
                     try {
                         stamped = JSON.parse(fs.readFileSync(path.join(destDir, STAMP), 'utf8')).sha ?? '';
                     }
                     catch { /* unstamped */ }
-                    if (stamped && localSha(destDir, skillFiles) !== stamped) {
+                    if (stamped && local !== stamped) {
                         warnings.push(`${agent}/${name}: edited locally — left alone (delete it to take the shipped copy)`);
                         steps.push(`${agent}/${name}=locally-modified`);
                         continue;

package/dist/commands/agent.js

@@ -91,6 +91,60 @@ async function endWorkspaceSession(record, summary) {
         return false;
     }
 }
+/** `team/<id>` → the `--building` form `resolveBuilding` takes; home → undefined. */
+function buildingFor(address) {
+    if (!address || !address.includes('/'))
+        return undefined;
+    const i = address.indexOf('/');
+    return `${address.slice(0, i)}:${address.slice(i + 1)}`;
+}
+/** Workspace DOs hold agent work sessions; a store or a local app does not. */
+function holdsWorkSessions(address) {
+    return !address.includes('/') || /^(team|workspace)\//.test(address);
+}
+/**
+ * Run an action in a given workspace (AWO-394) — the session lives in the workspace it works in,
+ * not in whichever one the daemon happens to dial. Home goes direct; others through the proxy.
+ */
+async function rpcIn(address, action, input, timeout) {
+    const { resolveBuilding } = await import('./workspace.js');
+    const routed = resolveBuilding(action, input, buildingFor(address));
+    return rpcOnce(routed.action, routed.input, timeout);
+}
+/**
+ * "hive2 (workspace/98bef9…)" rather than a bare id — what an agent reads to know where it is.
+ * Best-effort: the account roster (`workspace:list`), falling back to the address itself.
+ */
+async function workspaceLabel(address) {
+    const { describeAddress } = await import('../session-binding.js');
+    const plain = describeAddress(address);
+    if (address.includes('/') && !/^(team|workspace)\//.test(address))
+        return plain;
+    try {
+        const { daemonRpc } = await import('../daemon-client.js');
+        const res = await Promise.race([daemonRpc('workspace:list', {}), new Promise((r) => setTimeout(() => r(null), 4_000))]);
+        const inner = res?.result ?? res;
+        const id = address.includes('/') ? address.slice(address.indexOf('/') + 1) : String(inner?.current ?? '');
+        const hit = (inner?.workspaces ?? []).find((w) => String(w?.id ?? '') === id);
+        if (hit?.name)
+            return address.includes('/') ? `${hit.name}  (${plain})` : `${hit.name} — home (your default workspace)`;
+    }
+    catch { /* the roster is a nicety */ }
+    return plain;
+}
+/** End one work session where it lives. Best-effort, like `endWorkspaceSession`. */
+async function endSessionIn(address, sessionId, agentId, summary) {
+    try {
+        const r = await rpcIn(address, 'agent-session-end', {
+            id: sessionId, agentId, ...(summary?.trim() ? { summary: summary.trim() } : {}),
+        }, 5_000);
+        const result = r?.result ?? r;
+        return result?.ok !== false && !result?.error;
+    }
+    catch {
+        return false;
+    }
+}
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const green = (s) => `\x1b[32m${s}\x1b[0m`;
 const bold = (s) => `\x1b[1m${s}\x1b[0m`;
@@ -701,7 +755,38 @@ async function agentLogin(args, values) {
      * actually began. `existingRecord` is read before the write for exactly this.
      */
     const birthday = existingRecord?.birthday ?? new Date().toISOString();
-    const previousSessionEnded = await endWorkspaceSession(existingRecord);
+    /**
+     * ⚠⚠ ONE SESSION = THIS PROCESS SCOPE (AWO-394). A re-login replaces the session THIS scope had,
+     * and nothing else: it used to end `record.sessionId` — one field shared by every terminal using
+     * the name — so logging in from a second terminal closed the first terminal's session and both
+     * then wrote under the new one.
+     */
+    const { deriveAgentScope } = await import('../agent-scope.js');
+    const { readSessionBinding, writeSessionBinding, currentEnvName, normalizeWorkspaceAddress, describeAddress, } = await import('../session-binding.js');
+    const { writeTargetForScope, readTargetForKey } = await import('../cli-state.js');
+    const scope = deriveAgentScope();
+    const priorBinding = scope ? readSessionBinding(scope) : null;
+    if (priorBinding?.sessionId)
+        await endSessionIn(priorBinding.workspace, priorBinding.sessionId, minted.agentId);
+    /**
+     * WHERE THIS SESSION WORKS: `--workspace`, else where this identity last worked, else home. The
+     * identity's last workspace is what keeps a durable agent from losing its place each conversation
+     * — the reason the cursor used to be keyed on the agent name — without letting one live session
+     * move another.
+     */
+    const requestedWorkspace = typeof values.workspace === 'string' ? values.workspace.trim() : '';
+    const normalizedRequest = requestedWorkspace ? normalizeWorkspaceAddress(requestedWorkspace) : null;
+    if (requestedWorkspace && !normalizedRequest) {
+        console.error(`  Unrecognised workspace "${requestedWorkspace}".`);
+        console.error('  Use: home · team/<id> · workspace/<id> · a 64-character workspace id   (beehaven workspaces lists them)');
+        process.exit(1);
+    }
+    const legacyCursor = readTargetForKey(name)?.address;
+    const chosenWorkspace = normalizedRequest
+        || existingRecord?.lastWorkspace
+        || (legacyCursor ? normalizeWorkspaceAddress(legacyCursor) : null)
+        || 'workspace';
+    const sessionEnv = currentEnvName();
     /**
      * ⚠⚠ FILL THE LIFETIME FIELDS FROM THE TOKEN — the cloud mint path does not
      * return them and a record without `expiresAt` can never be seen as expired.
@@ -740,8 +825,9 @@ async function agentLogin(args, values) {
          * resuming is least recoverable.
          */
         ...(existingRecord?.boundScopes ? { boundScopes: existingRecord.boundScopes } : {}),
-        ...(!previousSessionEnded && existingRecord?.sessionId ? { sessionId: existingRecord.sessionId } : {}),
+        ...(existingRecord?.sessionId ? { sessionId: existingRecord.sessionId } : {}),
         ...(existingRecord?.lastLoginAt ? { lastLoginAt: existingRecord.lastLoginAt } : {}),
+        lastWorkspace: chosenWorkspace,
     };
     saveAgent(name, record);
     /**
@@ -754,10 +840,14 @@ async function agentLogin(args, values) {
      * instead of silently replaced. The family (what un-logged-in sessions inherit) is claimed
      * below, only once a session actually starts.
      */
-    const { deriveAgentScope } = await import('../agent-scope.js');
     const { bindAgentScope, agentForScope, loginSessionOutcome } = await import('../agent-state.js');
-    const scope = deriveAgentScope();
     bindAgentScope(name, scope, { family: false });
+    // The session record: identity + workspace + env, owned by this scope alone. Written before the
+    // workspace answers for the same reason the binding is — a refused login must still own its scope.
+    if (scope) {
+        writeSessionBinding({ scope, agent: name, workspace: chosenWorkspace, env: sessionEnv, boundAt: Date.now() });
+        writeTargetForScope(scope, chosenWorkspace, chosenWorkspace === 'workspace' ? 'cloud' : undefined);
+    }
     // Sync to Electron store if present
     try {
         const p = join(homedir(), 'Library', 'Application Support', 'clearly-desktop', 'config.json');
@@ -821,18 +911,36 @@ async function agentLogin(args, values) {
     // `loginSessionOutcome` — and is reported, never swallowed.
     let started;
     let thrown;
-    try {
-        started = await rpcOnce('agent-session-start', {
-            agentId: record.agentId,
-            client: String(values.client ?? 'cli').trim() || 'cli',
-            label: String(values.label ?? '').trim() || undefined,
-            expiresAt: record.expiresAt,
-        }, 15_000);
+    const sessionInput = {
+        agentId: record.agentId,
+        client: String(values.client ?? 'cli').trim() || 'cli',
+        label: String(values.label ?? '').trim() || undefined,
+        expiresAt: record.expiresAt,
+    };
+    if (holdsWorkSessions(chosenWorkspace)) {
+        try {
+            // ⚠ IN THE SESSION'S WORKSPACE (AWO-394) — it used to open in the daemon's default
+            // workspace whatever the cursor said, and that id then rode on calls to other workspaces.
+            started = await rpcIn(chosenWorkspace, 'agent-session-start', sessionInput, 15_000);
+            const first = loginSessionOutcome(started);
+            // An identity is the ACCOUNT's; each workspace admits it once. Same self-heal `call` does.
+            if (first.kind === 'refused' && chosenWorkspace !== 'workspace' && /unknown agent|not admitted|unknown-agent/i.test(`${first.scope} ${first.reason}`)) {
+                const admitted = await rpcIn(chosenWorkspace, 'agent-admit', { agentId: record.agentId }, 20_000).catch(() => null);
+                if ((admitted?.result ?? admitted)?.ok)
+                    started = await rpcIn(chosenWorkspace, 'agent-session-start', sessionInput, 15_000);
+            }
+        }
+        catch (err) {
+            thrown = err ?? new Error('agent-session-start failed');
+        }
     }
-    catch (err) {
-        thrown = err ?? new Error('agent-session-start failed');
+    const outcome = holdsWorkSessions(chosenWorkspace)
+        ? loginSessionOutcome(started, thrown)
+        : { kind: 'unreachable', reason: 'a store keeps no agent work sessions' };
+    if (outcome.kind === 'started' && scope) {
+        const { updateSessionBinding } = await import('../session-binding.js');
+        updateSessionBinding(scope, { sessionId: outcome.sessionId });
     }
-    const outcome = loginSessionOutcome(started, thrown);
     if (outcome.kind === 'started') {
         saveAgentSession(name, outcome.sessionId);
         /**
@@ -876,8 +984,11 @@ async function agentLogin(args, values) {
         if (scope) {
             const resolved = agentForScope(scope);
             if (resolved === name) {
-                console.log(`  ${green('✓')} Bound to this session (${cyan(scope)}) — every call here now runs as ${cyan(name)}.`);
-                console.log(dim('    Other terminals: export BEEHAVEN_AGENT=' + name));
+                console.log(`  This session  ${cyan(scope)}`);
+                console.log(`    Agent       ${cyan(name)}${dim('   every beehaven command here runs as this agent — nothing to pass per call')}`);
+                console.log(`    Workspace   ${cyan(await workspaceLabel(chosenWorkspace))}${dim('   switch: beehaven connect <workspace>')}`);
+                console.log(`    Env         ${cyan(sessionEnv)}${dim('   calls are refused if the daemon moves to another env')}`);
+                console.log(dim('  Other sessions and terminal tabs keep their own agent and workspace.'));
             }
             else {
                 console.error(`  ${yellow('⚠')} Could not bind this session (${scope}) to ${name}; calls resolve to ${resolved ?? 'nobody'}.`);
@@ -886,9 +997,10 @@ async function agentLogin(args, values) {
             }
         }
         else {
-            console.log('  Activate in THIS terminal:');
+            // No per-session handle: a terminal that does not say which tab it is.
+            console.log('  This terminal has no session id, so the sign-in is shared by every such terminal.');
+            console.log('  To keep it to THIS terminal:');
             console.log(`    ${cyan(`eval "$(beehaven agent use ${name})"`)}`);
-            console.log(dim(`  or: export BEEHAVEN_AGENT=${name}`));
         }
     }
     console.log('');
@@ -1159,6 +1271,14 @@ function agentWhoami(values) {
     console.log(`    birthday:    ${r.birthday ? formatBirthday(r.birthday) : 'unknown (created before birthdays)'}`);
     console.log(`    voice:       ${r.voice?.provider ? (r.voice.voiceId ? `${r.voice.provider}:${r.voice.voiceId}` : `${r.voice.provider} (base voice)`) : 'unbound — speak picks whatever is reachable'}`);
     console.log(`    expires:     ${formatRemaining(r.expiresAt)}`);
+    if (active.session) {
+        console.log(`    session:     ${active.session.scope}  (work session ${active.session.sessionId ? active.session.sessionId.slice(0, 8) : 'none'})`);
+        console.log(`    workspace:   ${active.session.workspace}`);
+        console.log(`    env:         ${active.session.env}`);
+    }
+    else {
+        console.log(dim('    session:     none bound here — `beehaven agent login ' + active.name + '` binds this session'));
+    }
     if (active.expired)
         console.log(dim(`    refresh: beehaven agent login ${active.name}`));
     console.log('');
@@ -1184,6 +1304,53 @@ async function agentStatus(args, values) {
     }
     console.log(`  ${green('✓')} ${cyan(name)} status: ${String(result.message ?? message)}`);
 }
+// ── connect, for a signed-in session ─────────────────
+/**
+ * `beehaven connect <address>` in a signed-in session (AWO-394): move THIS session — its cursor,
+ * its work session and its binding — and nothing else. The cursor file is already this session's;
+ * this moves the work session to the workspace it now works in (a session lives in one workspace's
+ * DO, and its id used to ride on calls to others), and remembers the workspace on the identity so
+ * the next login starts there.
+ */
+export async function moveAgentSession(address) {
+    const { activeSessionBinding } = await import('../agent-state.js');
+    const { updateSessionBinding, describeAddress } = await import('../session-binding.js');
+    const bound = activeSessionBinding();
+    if (!bound)
+        return;
+    const record = loadAgent(bound.agent);
+    if (!record)
+        return;
+    if (bound.workspace === address)
+        return;
+    if (bound.sessionId)
+        await endSessionIn(bound.workspace, bound.sessionId, record.agentId);
+    let sessionId;
+    if (holdsWorkSessions(address)) {
+        const input = { agentId: record.agentId, client: 'cli', expiresAt: record.expiresAt };
+        const { loginSessionOutcome } = await import('../agent-state.js');
+        try {
+            let r = await rpcIn(address, 'agent-session-start', input, 15_000);
+            let o = loginSessionOutcome(r);
+            if (o.kind === 'refused' && address !== 'workspace' && /unknown agent|not admitted|unknown-agent/i.test(`${o.scope} ${o.reason}`)) {
+                const admitted = await rpcIn(address, 'agent-admit', { agentId: record.agentId }, 20_000).catch(() => null);
+                if ((admitted?.result ?? admitted)?.ok) {
+                    console.error(dim(`  ${bound.agent} joined this workspace.`));
+                    r = await rpcIn(address, 'agent-session-start', input, 15_000);
+                    o = loginSessionOutcome(r);
+                }
+            }
+            if (o.kind === 'started')
+                sessionId = o.sessionId;
+            else if (o.kind === 'refused')
+                console.error(`  ${yellow('⚠')} ${bound.agent} has no work session here: ${o.reason}`);
+        }
+        catch { /* unreachable — calls still route; the next login opens a session */ }
+    }
+    updateSessionBinding(bound.scope, { workspace: address, sessionId });
+    saveAgent(bound.agent, { ...record, lastWorkspace: address });
+    console.log(dim(`  Session ${bound.scope} (${bound.agent}) now works in ${await workspaceLabel(address)}${sessionId ? ` · work session ${sessionId.slice(0, 8)}` : ''}. Other sessions are unaffected.`));
+}
 // ── handoff ──────────────────────────────────────────
 /**
  * End the current work session WITH a note — the one thing the next login (this agent's, or the
@@ -1203,6 +1370,22 @@ async function agentHandoff(args, values) {
         process.exit(1);
     }
     const record = loadAgent(name);
+    const { activeSessionBinding } = await import('../agent-state.js');
+    const bound = activeSessionBinding(name);
+    if (bound?.sessionId && record) {
+        // AWO-394 — hand off THIS session, where it lives; other sessions of the name are untouched.
+        if (!await endSessionIn(bound.workspace, bound.sessionId, record.agentId, summary)) {
+            console.error(`  ${yellow('⚠')} The workspace did not accept the handoff; the session is still open.`);
+            process.exitCode = 1;
+            return;
+        }
+        const { updateSessionBinding } = await import('../session-binding.js');
+        updateSessionBinding(bound.scope, { sessionId: undefined });
+        if (record.sessionId === bound.sessionId)
+            clearAgentSessionId(name);
+        console.log(`  ${green('✓')} Handed off session ${cyan(bound.sessionId.slice(0, 8))} — the next login for ${cyan(name)} reads this first.`);
+        return;
+    }
     if (!record?.sessionId) {
         console.error(`  ${yellow('⚠')} ${cyan(name)} has no open work session on this device.`);
         console.error(dim(`    Start one with: beehaven agent login ${name} --label "<work>" --client cli`));
@@ -1236,18 +1419,42 @@ async function agentLogout(args, values) {
     // it stays in the workspace (source of truth) AND on this device, so you can
     // log back in. To remove the current workspace projection use `agent delete <name>`;
     // to remove the portable account identity use `agent delete <name> --account --yes`.
-    await endWorkspaceSession(record);
-    try {
-        await rpcOnce('agent:disconnect', { agentId: record.agentId ?? name }, 5_000);
-    }
-    catch {
-        /* daemon down — nothing to close */
+    /**
+     * ⚠ AWO-394 — signing out ends THIS session (its binding, its work session, its cursor) and
+     * leaves every other session signed in as the same name running. It used to clear the shared
+     * record's session, which locked every other terminal using the name out at once.
+     */
+    const { activeSessionBinding, unbindAgentScope } = await import('../agent-state.js');
+    const { clearSessionBinding, listSessionBindings } = await import('../session-binding.js');
+    const bound = activeSessionBinding(name);
+    if (bound) {
+        if (bound.sessionId)
+            await endSessionIn(bound.workspace, bound.sessionId, record.agentId);
+        clearSessionBinding(bound.scope);
+        // …and this scope stops resolving to the name, or the next call here would still act as it.
+        unbindAgentScope(name, bound.scope);
+        if (record.sessionId && record.sessionId === bound.sessionId)
+            clearAgentSessionId(name);
+    }
+    else {
+        await endWorkspaceSession(record);
+        clearAgentSession(name);
+    }
+    const others = listSessionBindings().filter((b) => b.agent === name);
+    if (!others.length) {
+        try {
+            await rpcOnce('agent:disconnect', { agentId: record.agentId ?? name }, 5_000);
+        }
+        catch {
+            /* daemon down — nothing to close */
+        }
     }
-    clearAgentSession(name);
-    console.log(`  ${green('✓')} Signed out agent "${name}" — session ended, identity kept.`);
+    console.log(`  ${green('✓')} Signed out agent "${name}" ${bound ? 'in this session' : ''} — session ended, identity kept.`);
+    if (others.length)
+        console.log(dim(`  ${others.length} other session${others.length === 1 ? ' is' : 's are'} still signed in as ${name}.`));
     console.log(dim(`  Log back in: beehaven agent login ${name}   ·   workspace remove: beehaven agent delete ${name}`));
-    if (activeAgentName(values) === name && !values.agent) {
-        console.log(dim(`  This was your active agent — run: unset BEEHAVEN_AGENT`));
+    if (process.env.BEEHAVEN_AGENT === name && !values.agent) {
+        console.log(dim(`  BEEHAVEN_AGENT still names ${name} in this shell — run: unset BEEHAVEN_AGENT`));
     }
 }
 // ── delete (destructive — removes the identity from the workspace + device) ──

package/dist/commands/workspace.js

@@ -725,8 +725,18 @@ export { activeAgentWrap, setCliDoor, cliDoor, alreadyAttributed, BOOTSTRAP_ACTI
  * ambient identity and is correct for every verb that does not offer that flag.
  */
 export async function agentRpc(action, input, timeout, values = {}) {
-    const wrapped = activeAgentWrap(action, input, values);
-    return rpcOnce(wrapped.action, wrapped.input, timeout);
+    /**
+     * ⚠⚠ THE TYPED VERBS FOLLOW THE SESSION'S WORKSPACE, LIKE `call` (AWO-393). This sent a bare
+     * `rpcOnce` to the daemon's default workspace: after `connect team/<id>`, `beehaven call
+     * ticket-create` filed in the team and `beehaven ticket create` filed at home. Same resolver,
+     * same order as `cmdCall` — wrap as the agent first, then the building envelope around it.
+     */
+    const routed = { ...values };
+    const { resolveTargetBuilding } = await import('../session-target.js');
+    await resolveTargetBuilding(routed);
+    const wrapped = activeAgentWrap(action, input, routed);
+    const resolved = resolveBuilding(wrapped.action, wrapped.input, routed.building);
+    return rpcOnce(resolved.action, resolved.input, timeout);
 }
 /**
  * Does this result payload represent a failure? Mirrors `isFailurePayload` in the worker's
@@ -1260,7 +1270,13 @@ function printCallErrorHints(msg, action, values) {
     if (!values.json) {
         console.error('');
         console.error('\x1b[2m  Try:\x1b[0m');
-        if (s.includes('unknown action') || s.includes('404')) {
+        if (/admin:(store|team|workspace)-rpc/.test(s) && s.includes('not allowed')) {
+            // A store/team target is reached through an admin:*-rpc proxy, which the workspace refuses
+            // to members over the daemon. Platform admins have the HTTP door instead (PPO-444).
+            console.error(`\x1b[2m    beehaven admin do shopifyStore/<id> ${action} '<json>'   # platform admins: the operator door\x1b[0m`);
+            console.error(`\x1b[2m    beehaven admin dashboard shopifyStore/<id>         # state, logs, snapshots\x1b[0m`);
+        }
+        else if (s.includes('unknown action') || s.includes('404')) {
             console.error(`\x1b[2m    beehaven actions --search <name>  # find the mounted action\x1b[0m`);
             console.error(`\x1b[2m    beehaven pwd                      # confirm you\'re on the right DO\x1b[0m`);
         }

package/dist/session-binding.js

@@ -0,0 +1,135 @@
+/**
+ * session-binding — ONE AGENT SESSION = one identity + one workspace + one env (AWO-394).
+ *
+ * `agent login` used to scatter a session across three places with three different keys:
+ *   · the identity        — `agents/<name>.json`, shared by every terminal using that name
+ *   · the work session id — a field on that SAME shared record, so a second terminal's login
+ *                           ended the first terminal's session and both then wrote under the new one
+ *   · the cursor          — `target-<name>.json`, so two terminals as one agent shared a workspace,
+ *                           and an agent that never connected inherited the daemon's machine-global focus
+ *
+ * Founder, 2026-10-24: "If agent A is working in workspace1 and agent B is working in workspace1
+ * and agent A connects to shopify DO, would that be isolated" — it was not, reliably. This file is
+ * the per-session record that makes it so: keyed on the PROCESS SCOPE (`deriveAgentScope()`: a
+ * Claude/Codex/Gemini session, a terminal tab, or an explicit `BEEHAVEN_AGENT`), written by
+ * `agent login`, moved only by `connect` in that same session, and read by every verb.
+ *
+ * ⚠ A LEAF MODULE, LIKE `agent-scope.ts`. `agent-state` (identity) and `cli-state` (cursor) both
+ * read it, so it may import neither — that is the cycle `agent-scope.ts` documents.
+ *
+ * ⚠ THE ENV IS PART OF THE SESSION. One daemon dials one relay; `beehaven env prod` in any
+ * terminal re-points every session on the machine. A session remembers the env it was opened on so
+ * a call after such a switch is refused with the fix, instead of landing in another environment's
+ * workspace under the same name.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveRelaySelection } from './relay-presets.js';
+const SESSIONS_DIR = join(homedir(), '.beehaven', 'sessions');
+/** Filesystem key for a scope — the same sanitising rule the cursor file uses. */
+export function scopeKey(scope) {
+    return String(scope || '').trim().replace(/[^A-Za-z0-9_-]/g, '');
+}
+function fileFor(scope) {
+    const key = scopeKey(scope);
+    return key ? join(SESSIONS_DIR, `${key}.json`) : null;
+}
+export function readSessionBinding(scope) {
+    try {
+        const file = fileFor(scope);
+        if (!file || !existsSync(file))
+            return null;
+        const b = JSON.parse(readFileSync(file, 'utf8'));
+        if (!b || typeof b.agent !== 'string' || !b.agent || typeof b.workspace !== 'string')
+            return null;
+        return { ...b, scope };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSessionBinding(binding) {
+    const file = fileFor(binding.scope);
+    if (!file)
+        throw new Error('This process has no scope to bind a session to — set BEEHAVEN_AGENT=<name>.');
+    mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(binding, null, 2), { mode: 0o600 });
+    renameSync(tmp, file);
+}
+export function updateSessionBinding(scope, patch) {
+    const cur = readSessionBinding(scope);
+    if (!cur)
+        return null;
+    const next = { ...cur, ...patch, scope };
+    writeSessionBinding(next);
+    return next;
+}
+export function clearSessionBinding(scope) {
+    try {
+        const file = fileFor(scope);
+        if (file && existsSync(file))
+            unlinkSync(file);
+    }
+    catch { /* already gone */ }
+}
+/** Every session bound on this machine — `agent list` shows them, `logout --all` ends them. */
+export function listSessionBindings() {
+    try {
+        if (!existsSync(SESSIONS_DIR))
+            return [];
+        return readdirSync(SESSIONS_DIR)
+            .filter((f) => f.endsWith('.json'))
+            .map((f) => readSessionBinding(f.slice(0, -5)))
+            .filter((b) => !!b);
+    }
+    catch {
+        return [];
+    }
+}
+/** The env this machine's daemon dials right now (`beehaven env`). */
+export function currentEnvName() {
+    try {
+        const p = join(homedir(), '.beehaven', 'config.json');
+        const cfg = existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : {};
+        return resolveRelaySelection(cfg).envName;
+    }
+    catch {
+        return 'prod';
+    }
+}
+/**
+ * Why this session must not run here, or null. A session opened on staging is refused after
+ * someone switched the daemon to prod — the same workspace address names different data there.
+ */
+export function envMismatch(binding, now = currentEnvName()) {
+    if (!binding?.env || binding.env === now)
+        return null;
+    return `This session (${binding.agent}) was opened on ${binding.env}, but the daemon is now on ${now}.\n`
+        + `  Switch back:  beehaven env ${binding.env}\n`
+        + `  Or start a ${now} session here:  beehaven agent login ${binding.agent}`;
+}
+/** `workspace` / `team/<id>` / a bare 64-hex id → the address a cursor stores. */
+export function normalizeWorkspaceAddress(input) {
+    const v = String(input || '').trim();
+    if (!v)
+        return null;
+    if (['home', 'me', 'workspace'].includes(v))
+        return 'workspace';
+    if (/^[0-9a-f]{64}$/i.test(v))
+        return `workspace/${v.toLowerCase()}`;
+    if (/^[A-Za-z][A-Za-z0-9]*\/[A-Za-z0-9._:-]{1,200}$/.test(v))
+        return v;
+    return null;
+}
+/** Human label for an address — `home`, `team bld_…`, `shopifyStore clearly-demo`. */
+export function describeAddress(address) {
+    if (!address || ['workspace', 'home', 'me'].includes(address))
+        return 'home (your default workspace)';
+    const i = address.indexOf('/');
+    if (i < 0)
+        return address;
+    const id = address.slice(i + 1);
+    return `${address.slice(0, i)} ${id.length > 20 ? `${id.slice(0, 12)}…` : id}`;
+}

package/dist/session-target.js

@@ -0,0 +1,91 @@
+/**
+ * session-target — THE ONE ANSWER TO "WHERE DOES THIS CALL LAND?" (CLR-1161, AWO-393, AWO-394).
+ *
+ * `call`, `actions`, `batch`, `explain`, `code-run` and `watch git` resolved the cursor here (it
+ * lived inline in cli.ts); the typed verbs — `ticket`, `sheet`, `slides`, `design`, `mention`,
+ * `trash` — went through `agentRpc`, which never asked. So an agent connected to a team workspace
+ * ran `beehaven call ticket-create` in the team and `beehaven ticket create` in its home, in one
+ * terminal, with no warning (AWO-393). Every verb now resolves through this function.
+ *
+ * ⚠⚠ AN AGENT SESSION NEVER READS OR MOVES THE DAEMON'S FOCUS. The daemon's `connectedBuilding` is
+ * one variable for the whole machine: any terminal's `connect` sets it and any `connect home`
+ * clears it. A human with no cursor file still inherits it (that is the long-standing behaviour a
+ * person can see and correct); an agent with no cursor is at HOME, full stop — that is what makes
+ * agent A connecting to a Shopify store invisible to agent B in the same workspace.
+ *
+ * ⚠ THE SESSION'S ENV IS CHECKED HERE TOO, so every verb that routes also refuses a session opened
+ * on another environment (see `envMismatch`).
+ */
+import { getTarget, isHomeAddress } from './cli-state.js';
+import { activeAgentName, activeSessionBinding } from './agent-state.js';
+import { isAgentRuntime } from './agent-scope.js';
+import { envMismatch } from './session-binding.js';
+/** Is this invocation an agent's (a signed-in identity, or a harness that must sign in)? */
+export function isAgentInvocation(values = {}) {
+    try {
+        return !!activeAgentName(values) || isAgentRuntime();
+    }
+    catch {
+        return isAgentRuntime();
+    }
+}
+/** Why this session must not run (another env), or null. */
+export function sessionRefusal(values = {}) {
+    try {
+        return envMismatch(activeSessionBinding(activeAgentName(values)));
+    }
+    catch {
+        return null;
+    }
+}
+export async function resolveTargetBuilding(values) {
+    const refusal = sessionRefusal(values);
+    if (refusal) {
+        console.error(`  ${refusal}`);
+        process.exit(1);
+    }
+    if (values.building)
+        return; // an explicit flag always wins
+    const t = getTarget();
+    if (t?.address?.includes('/')) {
+        const [bType, ...bIdParts] = t.address.split('/');
+        values.building = `${bType}:${bIdParts.join('/')}`;
+        return;
+    }
+    // ⚠ An agent: no file, or a home file, both mean HOME — never the machine-global focus, and an
+    // agent's call never clears the focus a person in another terminal set.
+    if (isAgentInvocation(values))
+        return;
+    if (t && isHomeAddress(t.address)) {
+        /**
+         * ⚠ HOME IS A POSITIVE STATEMENT, NOT AN ABSENCE. The daemon's focus is a routing
+         * optimisation; the file is where the user said to be. If they disagree the daemon is
+         * stale — drop it, so the call lands where `pwd` says it will, and SAY so.
+         */
+        try {
+            const { daemonGetConnection, daemonDisconnect } = await import('./daemon-client.js');
+            const conn = await daemonGetConnection();
+            if (conn?.buildingId) {
+                await daemonDisconnect();
+                console.error(`\x1b[2m  (dropped a stale daemon focus on ${conn.buildingType}/${conn.buildingId}`
+                    + ` — your target is home)\x1b[0m`);
+            }
+        }
+        catch { /* no daemon, or it refused — home is the default route anyway */ }
+        return;
+    }
+    if (!t) {
+        /**
+         * ⚠ A PERSON WITH NO TARGET EVER SET inherits the daemon's connection — kept for back-compat
+         * with terminals that `connect` through the daemon and never wrote a file. Agents are handled
+         * above and never reach this.
+         */
+        try {
+            const { daemonGetConnection } = await import('./daemon-client.js');
+            const conn = await daemonGetConnection();
+            if (conn)
+                values.building = `${conn.buildingType}:${conn.buildingId}`;
+        }
+        catch { /* fall through to home */ }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beehaven",
-  "version": "0.8.33",
+  "version": "0.8.34",
   "description": "Beehaven CLI — command your Clearly workspace, agents, and canvas from the terminal",
   "private": false,
   "type": "module",
@@ -53,7 +53,7 @@
     }
   },
   "optionalDependencies": {
-    "better-sqlite3": "11.0.0",
+    "better-sqlite3": "13.0.3",
     "node-pty": "1.0.0",
     "open": "10.1.0"
   },

package/skills/clearly-agent/SKILL.md

@@ -5,14 +5,30 @@ description: Needs a terminal with the beehaven CLI (Claude Code, Codex, Gemini
 
 # clearly-agent — who you are, and what that makes your work
 
-## Select the workspace, then sign in once
+## Sign in once — this session is then you, in one workspace
 
 ```bash
-beehaven env
-beehaven connect home
-beehaven agent login <name> --label "what I am here to do" --client cli
+beehaven env                                   # staging or prod: the session remembers it
+beehaven agent login <name> --label "what I am here to do" --client cli [--workspace <ws>]
 ```
 
+After login **every** `beehaven` command in this session runs as `<name>`, in its workspace — no
+`--agent`, no export, nothing per call. The login prints the session, the agent, the workspace (by
+name) and the env. `--workspace` takes `home`, `workspace/<id>`, `team/<id>` or a bare 64-character
+id (`beehaven workspaces` lists them); without it a session starts where this identity last worked.
+
+**One session = one identity + one workspace + one env (AWO-394).** A session is a Claude/Codex/
+Gemini conversation, or a terminal tab. Each has its own:
+- workspace — `beehaven connect <ws>` moves THIS session only (and moves its work session there);
+  another agent, or another conversation signed in as the same name, stays where it is;
+- work session — a second login under the same name no longer ends the first one's;
+- env — if someone switches the daemon (`beehaven env prod`), calls from a staging session are
+  refused with the fix instead of landing in the other environment.
+
+Typed verbs (`ticket`, `sheet`, `slides`, `design`, `mention`, `trash`) follow the session's
+workspace exactly like `call` (AWO-393). A Shopify store is an operator target:
+`beehaven admin do shopifyStore/<id> <action> '<json>'` (platform admins).
+
 ## Personal workspace means a private layer, not another DO
 
 Every human and every agent in the selected workspace has a **personal workspace layer**: its own
@@ -38,13 +54,14 @@ steps. CI gets a real identity for one command: `beehaven agent login ci`.
 | 2 | `BEEHAVEN_AGENT=<name>` | a script, or another terminal |
 | 3 | the **scope binding** from `agent login` | this session, no flag needed |
 
-⚠ **The binding needs no cooperation.** `agent login` records the calling process's scope —
-`claude-<sessionId>`, `codex-…`, `gemini-…`, or `pid-<ppid>` for a non-TTY — on the identity. So
-two harness sessions are two agents concurrently with no env var, and **two agents on one scope is
-refused rather than guessed** (that can only happen if you logged in twice from one session).
+⚠ **The binding needs no cooperation.** `agent login` writes `~/.beehaven/sessions/<scope>.json` for
+the calling process's scope — `claude-<sessionId>`, `codex-…`, `gemini-…`, `term-<tab>` for a
+terminal tab that says which tab it is (macOS Terminal, iTerm2, Windows Terminal, tmux, kitty,
+WezTerm), or `pid-<ppid>` for a non-TTY. Two harness sessions or two tabs are two agents
+concurrently with no env var; logging in twice from one session means the second login.
 
-⚠ The workspace **cursor** is scoped the same way, so two identities can be `connect`ed to
-different workspaces at once. What is NOT concurrent: one daemon, one relay, one `beehaven env`.
+⚠ What is still machine-wide: one daemon, one relay, one `beehaven env` (sessions refuse a mismatch
+rather than follow it). `agent logout` ends this session only.
 
 ## Identity ≠ session
 

package/skills/clearly-canvas/authoring.md

@@ -147,11 +147,12 @@ deliverable requires them, with content order and hierarchy reconsidered for the
 
 The same rules the in-app assistant works to (canvas-catalog returns them as `technique`).
 
-- AUTO-LAYOUT: rows, stacks and grids are a frame whose children you create in reading order, then canvas.auto-layout { id, direction: "h" | "v" | "grid", gap, padding, align, justify, hug }. hug:false keeps the frame size; justify "space-between" | "space-around" | "space-evenly" are the Auto gaps; align:"baseline" lines up text in a row. Grids take columns, rows, columnGap, rowGap, columnSizes / rowSizes ("fill", "2fr", "hug", px). wrap:true flows into new rows; give Fill cards a minW so they wrap where you mean. Child settings go on the child via canvas.update-nodes: layoutSizingH/V "fill" | "hug" | "fixed", minW / maxW / minH / maxH, gridColumn / gridRow / gridColumnSpan, layoutPositioning:"absolute". The frame stays live: children created into it (parentId) flow in. Spacing variables: canvas.variable { op: "bind", ids, field, name }.
+- AUTO-LAYOUT: build every row, stack, card and grid AS an auto-layout frame from the start: frame.create (or canvas.create-node type "frame") { name, parentId, autoLayout: { direction: "h" | "v" | "grid", gap, padding, align, justify, hug } }, then create its children with parentId and NO x/y; they flow in creation order and the frame stays live. canvas.auto-layout { id, … } changes the settings; with only { id } it converts a hand-positioned frame, reading direction, gap and padding off the children so nothing moves, and review reports any stack left positioned by hand. hug:false keeps the frame size; justify "space-between" | "space-around" | "space-evenly" are the Auto gaps; align:"baseline" lines up text in a row. Grids take columns, rows, columnGap, rowGap, columnSizes / rowSizes ("fill", "2fr", "hug", px). wrap:true flows into new rows; give Fill cards a minW so they wrap where you mean. Child settings go on the child via canvas.update-nodes: layoutSizingH/V "fill" | "hug" | "fixed", minW / maxW / minH / maxH, gridColumn / gridRow / gridColumnSpan, layoutPositioning:"absolute".
+- VARIABLES: use the brand by name, not by value: in canvas.create-node and frame.create write fill: "brand/accent", stroke: "brand/line", radius: "brand/radius", autoLayout: { gap: "brand/spacing", padding: "brand/spacing" }, and on text textStyle: "brand/heading" (or "brand/body"), which sets family, weight, size, line height and letter spacing together from the brand's type role. Each binds, so the layer follows the canvas brand and a switch of brand; "var/<name>" reaches a workspace variable (text: "var/product/name", visible: "var/flags/promo"). A dark version of a frame is variableModes: { brand: "dark" } on it, not new colours. canvas.variable binds existing layers (op "bind", "apply-style", "set-mode"); op "list" shows every variable and style. A typed value detaches.
 - GRADIENTS: gradient { kind, angle, stops: [{ offset, color }] } replaces the solid fill. angle is the direction the colour travels: 0 = left to right, 90 = top to bottom, 45 = top-left to bottom-right (not CSS degrees). Use two or three stops from the brand palette, and keep text off a busy gradient or check its contrast in canvas.review.
 - SHADOWS AND BLUR: effects on any node. A soft card shadow is { type: "drop-shadow", x: 0, y: 4, blur: 16, spread: 0, color: "#0000001F" }; frosted glass is { type: "background-blur", blur: 16 }. Never fake a shadow with an extra rectangle.
-- DRAWING: build every mark, icon, illustration and diagram shape from native layers, as a designer does in Figma, never as one generated SVG file. Primitives are canvas.create-node rect and ellipse; curves are pen paths, vector.create { name, parentId, points: [{ x, y, hIn?: { x, y }, hOut?: { x, y } }], closed, fill or stroke, strokeWidth }, where hIn/hOut are absolute control points: use few anchors with smooth handles. It also takes d (SVG path data, converted to native editable points) or shape: petal|circle|polygon|star|arc|spiral with cx, cy and sizes; strokeCap/strokeJoin apply. Reshape in place with canvas.update-nodes { ids, patch: { points | d | shape } }. Draw a repeated part once: canvas.repeat { id, count, around | cx, cy } turns one petal into a flower; canvas.rotate { ids, angle, cx, cy }; canvas.boolean { ids, op: "union" | "subtract" | "intersect" | "exclude" } (exact, editable operands). Work back to front: ground, big silhouettes in flat brand colours, then features, then details and highlights; check the silhouette in canvas.review before detailing. Name layers by part ("fox/ear-left"), group each figure with canvas.group { ids, name } and set overlap with canvas.order { ids, op }. Keep one stroke weight per drawing. Photographic or painterly imagery is a placed raster. Raw SVG stays supported but is never the default: when an SVG is asked for, write the markup yourself as an svg node, canvas.create-node { type: "svg", name, w, h, svg } with <svg viewBox="0 0 W H"> matching w and h, or import existing markup the same way; never an SVG generation pipeline.
-- COMPUTED GEOMETRY: shapes from math (radial petals, spirals, grids) are computed and drawn in ONE call: canvas-act { compositionId, script } runs JavaScript with geo.petal/circle/arc/star/polygon/spiral/smooth/rotate/radial/grid/bounds (degrees, 0 = 3 o'clock, clockwise) and a read-only scene list, then applies the { action, args } steps it returns. Never copy numbers from one tool result into another call.
+- DRAWING: build every mark, icon, illustration and diagram shape from native layers, as a designer does in Figma, never as one generated SVG file. Primitives are canvas.create-node rect and ellipse; curves are pen paths, vector.create { name, parentId, d, fill or stroke, strokeWidth }: write d as SVG path data (M, C, Z), native editable points in far fewer tokens than points: [{ x, y, hIn?, hOut? }] (hIn/hOut are absolute control points); few anchors, smooth curves. It also takes shape: petal|circle|polygon|star|arc|spiral with cx, cy and sizes; strokeCap/strokeJoin apply. Reshape in place with canvas.update-nodes { ids, patch: { points | d | shape } }. Draw a repeated part once: canvas.repeat { id, count, around | cx, cy } turns one petal into a flower; canvas.rotate { ids, angle, cx, cy }; canvas.boolean { ids, op: "union" | "subtract" | "intersect" | "exclude" } (exact, editable operands). Work back to front: ground, big silhouettes in flat brand colours, then features, then details and highlights; check the silhouette in canvas.review before detailing. Name layers by part ("fox/ear-left"), group each figure with canvas.group { ids, name } and set overlap with canvas.order { ids, op }. Keep one stroke weight per drawing. Photographic or painterly imagery is a placed raster. Raw SVG stays supported but is never the default: when an SVG is asked for, write the markup yourself as an svg node, canvas.create-node { type: "svg", name, w, h, svg } with <svg viewBox="0 0 W H"> matching w and h, or import existing markup the same way; never an SVG generation pipeline.
+- COMPUTED GEOMETRY: shapes from math (radial petals, spirals, grids) are computed and drawn in ONE call: canvas-act { compositionId, script } runs JavaScript with geo.petal/circle/arc/star/polygon/spiral/smooth/rotate/radial/grid/bounds (degrees, 0 = 3 o'clock, clockwise) and a read-only scene list, then applies the { action, args } steps it returns. Never copy numbers from one tool result into another call. A new top-level artboard goes beside or below what scene already holds (or leave out both x and y), never at 0,0 over an existing one.
 - SHEETS: several concepts or variants go on canvas.sheet { name, title, subtitle, cards or count, cols, cardW, cardH }: a live wrap grid of card frames that own their captions, so rows never overlap. Draw into a card with parentId = its id.
 - MEASURE: answer spacing, overlap and alignment questions with canvas.measure { frame } or { ids } and quote its numbers, never from memory or a preview.
 - PLACEHOLDERS: until real imagery exists, draw a native placeholder at the final size in a muted brand tone, never a flat accent block: a rect with the slot radius plus a simple motif (an ellipse sun, a vector.create mountain), grouped with canvas.group and named "<section> image placeholder", with any label in its own text node.

package/skills/index.json

@@ -17,7 +17,7 @@
       "project-plans.md",
       "review.mjs"
     ],
-    "sha": "5daf296f2bdf65e6"
+    "sha": "e23e25bd46b02d9c"
   },
   {
     "name": "agent-home",
@@ -82,7 +82,7 @@
     "files": [
       "SKILL.md"
     ],
-    "sha": "c20b255224221342"
+    "sha": "11505106cb1dd287"
   },
   {
     "name": "visualize",