beehaven 0.8.37 → 0.8.39

package/dist/agent-limit-refusal.js

@@ -0,0 +1,43 @@
+/**
+ * MCP2-65 — what `beehaven agent login <new name>` says when the workspace already has all the
+ * agents its plan includes (Free includes one).
+ *
+ * The identity mints at the account; joining the workspace is where the cap refuses
+ * (`agent-session-start` → automatic admission → `agent-create`, code `agent-limit-reached`). The
+ * reason alone left the person at a wall. The three choices, in this order:
+ *   1. log in as an agent they already have — one agent works from several apps;
+ *   2. upgrade for more agents (a pricing link: this is the terminal, not an MCP tool result);
+ *   3. archive one in Agents settings, then log in again.
+ *
+ * Pure: returns plain lines, the command colours them.
+ */
+export const AGENT_LIMIT_CODE = 'agent-limit-reached';
+export function isAgentLimitRefusal(code) {
+    return String(code ?? '') === AGENT_LIMIT_CODE;
+}
+/** An absolute pricing link from the refusal's relative `upgradeUrl` and the web origin for this env. */
+export function upgradeLink(origin, upgradeUrl) {
+    const base = String(origin || 'https://www.clearly.sh').replace(/\/+$/, '');
+    const raw = typeof upgradeUrl === 'string' ? upgradeUrl.trim() : '';
+    // Only a site-relative path is joined; anything else falls back to the pricing page.
+    const path = /^\/(?!\/)[A-Za-z0-9/_?=&.-]*$/.test(raw) ? raw : '/pricing';
+    return `${base}${path}`;
+}
+export function agentLimitLoginLines(opts) {
+    const agents = (Array.isArray(opts.details?.activeAgents) ? opts.details.activeAgents : [])
+        .map((a) => ({ id: String(a?.id ?? '').trim(), name: String(a?.name ?? '').trim() }))
+        .filter((a) => a.id && a.id !== opts.name);
+    const first = agents[0];
+    const listed = agents.map((a) => (a.name && a.name !== a.id ? `${a.id} ("${a.name}")` : a.id)).join(', ');
+    const reason = String(opts.reason || '').trim();
+    return {
+        headline: `Signed in, but ${opts.workspace || 'this workspace'} is at its agent limit${reason ? `: ${reason}` : '.'}`,
+        choices: [
+            first
+                ? `Use the agent you already have (one agent works from several apps): beehaven agent login ${first.id}${agents.length > 1 ? `   · also yours here: ${listed}` : ''}`
+                : 'Use an agent you already have (one agent works from several apps): beehaven agent login <its name>',
+            `Upgrade for more agents: ${upgradeLink(opts.origin, opts.details?.upgradeUrl)}`,
+            `Or archive one in Agents settings, then run: beehaven agent login ${opts.name}`,
+        ],
+    };
+}

package/dist/agent-mint-response.js

@@ -0,0 +1,10 @@
+/** Only an explicit appearance choice may rebind a portable identity on another device. */
+export function accountMintRequest(agentId, requestedAvatarId) {
+    return { agentId, ...(requestedAvatarId ? { avatarId: requestedAvatarId } : {}) };
+}
+export function accountMintResponse(response) {
+    const value = response?.result ?? response;
+    if (!value?.token)
+        throw Object.assign(new Error(`${String(value?.error || 'The server returned no agent token')}${value?.code ? ` (${value.code})` : ''}`), { code: value?.code || 'mint-refused' });
+    return value;
+}

package/dist/agent-state.js

@@ -365,11 +365,18 @@ export function loginSessionOutcome(started, thrown) {
         return { kind: 'started', sessionId: id, brief: payload?.brief };
     const err = payload?.error ?? started?.error;
     if (err) {
+        const code = String(payload?.code ?? started?.code ?? '');
         return {
             kind: 'refused',
             reason: typeof err === 'string' ? err : String(err?.message ?? JSON.stringify(err)),
-            code: String(payload?.code ?? started?.code ?? ''),
+            code,
             scope: String(payload?.scope ?? started?.scope ?? ''),
+            // MCP2-65: the agent-cap refusal names the caller's live agents and a pricing path, so the
+            // login can print the three choices instead of a bare reason.
+            ...(code === 'agent-limit-reached' ? { details: {
+                    activeAgents: Array.isArray(payload?.activeAgents) ? payload.activeAgents : [],
+                    ...(typeof payload?.upgradeUrl === 'string' ? { upgradeUrl: payload.upgradeUrl } : {}),
+                } } : {}),
         };
     }
     return { kind: 'refused', reason: 'the workspace returned no session', code: '', scope: '' };

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = '7674ddaca41b';
+export const BUILD_SHA = '3026e5a147f9';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-29T21:35Z';
+export const BUILD_TIME = '2026-11-12T22:52Z';
 /**
  * The build identity as one short string, for `--version`.
  *

package/dist/call-brief.js

@@ -58,14 +58,29 @@ function batchReceipt(action, r) {
     for (const s of steps)
         counts.set(verb(s?.action ?? '?'), (counts.get(verb(s?.action ?? '?')) ?? 0) + 1);
     const mix = [...counts].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([a, n]) => (n > 1 ? `${a} ×${n}` : a)).join(', ');
+    /**
+     * CDS-163 — THE BATCH'S OWN DELTA WINS. Only update steps carry a per-step `canvasChanges`, so
+     * summing steps printed "+0 ~69 −0 layers" for a 343-step build that created 211 layers. The worker
+     * returns one batch-level `canvasChanges`, diffed over every node the batch addressed (creates
+     * included); the per-step sum is kept for an older worker that does not send it.
+     */
     let added = 0, changed = 0, removed = 0, sawDelta = false;
-    for (const s of steps) {
-        const d = s?.value?.canvasChanges;
-        if (d && typeof d === 'object' && !Array.isArray(d)) {
-            sawDelta = true;
-            added += Number(d.added || 0);
-            changed += Number(d.changed || 0);
-            removed += Number(d.removed || 0);
+    const isDelta = (d) => !!d && typeof d === 'object' && !Array.isArray(d);
+    if (isDelta(r.canvasChanges)) {
+        sawDelta = true;
+        added = Number(r.canvasChanges.added || 0);
+        changed = Number(r.canvasChanges.changed || 0);
+        removed = Number(r.canvasChanges.removed || 0);
+    }
+    else {
+        for (const s of steps) {
+            const d = s?.value?.canvasChanges;
+            if (isDelta(d)) {
+                sawDelta = true;
+                added += Number(d.added || 0);
+                changed += Number(d.changed || 0);
+                removed += Number(d.removed || 0);
+            }
         }
     }
     const rev = r.canvasNodesRev ?? [...steps].reverse().find((s) => s?.value?.canvasNodesRev != null)?.value?.canvasNodesRev;

package/dist/cli.js

@@ -1881,6 +1881,7 @@ async function run() {
      * would be refused while `conversations --json` worked.
      */
     const JSON_CAPABLE = new Set([
+        'doc', 'search',
         'admin', 'apps', 'd1', 'describe', 'explain', 'marketplace', 'secrets',
         'shop', 'user', 'webhook', 'webhooks', 'workspaces', 'ws',
         // Honour what the modules already implement.
@@ -3064,13 +3065,13 @@ async function run() {
             }
             console.log('');
             console.log(`  ${color.green('✓')} Signed in as ${color.bold(captured.email ?? captured.userId)}`);
-            console.log(`    Tokens stored in keychain + ~/.beehaven/config.json`);
+            console.log(`    Sign-in saved on this device`);
             // Auto-restart the daemon. New tokens won't take effect until
             // the daemon restarts (it reads creds at startup, keeps them
             // in memory, has no hot-reload IPC verb). Doing the restart
             // here matches gh / firebase-tools UX — login-then-go.
             const { findLiveDaemons, stopDaemonProcess } = await import('./daemon.js');
-            const { spawnStandaloneDaemon } = await import('./commands/daemon-cmd.js');
+            const { spawnStandaloneDaemon, waitForLoginConnection } = await import('./commands/daemon-cmd.js');
             /**
              * ⚠⚠ THE RESTART IS PLUMBING AND WAS NARRATED AS THOUGH IT WERE THE POINT. What a person saw
              * after signing in was:
@@ -3115,6 +3116,7 @@ async function run() {
              * started with developer scope.
              */
             const pid = spawnStandaloneDaemon(values);
+            const connection = await waitForLoginConnection();
             /**
              * ⚠ ONE OUTCOME LINE, IN THE SAME SHAPE AS THE ONE ABOVE IT. `✓ (PID 73532)` was a tick, a
              * bracket and a number — grammatically nothing, and unreadable as a result. This says what
@@ -3125,7 +3127,16 @@ async function run() {
              * `beehaven status` labels the same thing `Relay:`. Naming the outcome rather than the
              * process is what stops a sign-in ending on the word "stopped".
              */
-            console.log(`  ${color.green('✓')} Connected — your new sign-in is live`);
+            if (connection.ready) {
+                console.log(`  ${color.green('✓')} Connected — your new sign-in is live`);
+            }
+            else {
+                console.error(`  ${color.yellow('!')} Signed in, but the workspace connection is not ready.`);
+                console.error(connection.reason === 'environment-mismatch'
+                    ? '    The running service is on a different environment. Run `beehaven status` before retrying.'
+                    : '    Run `beehaven status` to check the connection, then retry your workspace command.');
+                process.exitCode = 2;
+            }
             console.log(`    Background service ${wasRunning ? 'restarted' : 'started'} (PID ${pid})`);
             /**
              * ⚠⚠ TEACH THE AGENTS AS PART OF SIGNING IN (PPO-190). "Install the CLI, log in, and your

package/dist/commands/agent.js

@@ -25,6 +25,8 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { rpcOnce } from '../ipc-client.js';
+import { accountMintRequest, accountMintResponse } from '../agent-mint-response.js';
+import { agentLimitLoginLines, isAgentLimitRefusal } from '../agent-limit-refusal.js';
 import { saveAgent, loadAgent, listAgents, deleteAgent, findAgentByAvatar, isValidAgentName, resolveActiveAgent, activeAgentName, saveAgentSession, clearAgentSession, clearAgentSessionId, decodeAgentTokenClaims, } from '../agent-state.js';
 const VALID_KINDS = ['claude-code', 'daemon-agent', 'clearly-ai'];
 export const FREE_SKINS = [
@@ -643,7 +645,7 @@ async function agentLogin(args, values) {
     }
     const avatarId = requestedAvatarId || existingRecord?.avatarId || chosenSkin || name;
     // Local-first avatar-collision guard (durable guard is the cloud pool).
-    const collision = findAgentByAvatar(avatarId, name);
+    const collision = requestedAvatarId ? findAgentByAvatar(requestedAvatarId, name) : null;
     if (collision) {
         console.error(`  Avatar "${avatarId}" is already claimed by agent "${collision}".`);
         console.error(`  Pick another: beehaven agent login ${name} --avatar <other-id>`);
@@ -670,7 +672,7 @@ async function agentLogin(args, values) {
      * credential.
      */
     try {
-        const cloud = await rpcOnce('agent-account-mint', { agentId: name, avatarId }, 15_000);
+        const cloud = accountMintResponse(await rpcOnce('agent-account-mint', accountMintRequest(name, requestedAvatarId), 15_000));
         const tok = cloud?.token ?? cloud?.result?.token;
         if (tok) {
             minted = {
@@ -698,7 +700,14 @@ async function agentLogin(args, values) {
     }
     catch (err) {
         console.error(`  Could not mint identity: ${err?.message ?? err}`);
-        console.error('  Is the daemon connected? Check with: beehaven status');
+        if (String(err?.code) === 'identity-limit-reached') {
+            // MCP2-71: the account's safety ceiling — no plan lifts it; signing in as one you have always works.
+            console.error('  Sign in as an agent you already have: beehaven agent list, then beehaven agent login <name>');
+            console.error('  Or delete one you no longer use in Agents, then run this again.');
+            process.exit(1);
+        }
+        if (!err?.code || /^(ECONN|ENOENT|ETIMEDOUT)/.test(String(err.code)))
+            console.error('  Is the daemon connected? Check with: beehaven status');
         process.exit(1);
     }
     /**
@@ -962,6 +971,21 @@ async function agentLogin(args, values) {
         console.log(`  ${green('◷')} Workspace work session ${cyan(outcome.sessionId.slice(0, 8))} started.`);
         printBrief(outcome.brief);
     }
+    else if (outcome.kind === 'refused' && isAgentLimitRefusal(outcome.code)) {
+        // MCP2-65: at the plan's agent limit, say what to do — not just that it was refused.
+        const { resolveAuthOrigin } = await import('../browser-login.js');
+        const lines = agentLimitLoginLines({
+            name, workspace: (await workspaceLabel(chosenWorkspace)).split(/ {2}\(| — /)[0], reason: outcome.reason,
+            details: outcome.details, origin: resolveAuthOrigin().authOrigin,
+        });
+        console.log('');
+        console.error(`  ${yellow('⚠')} ${lines.headline}`);
+        console.error('    Your choices:');
+        for (const line of lines.choices)
+            console.error(`    · ${line}`);
+        console.error(dim(`    Calls from this session run as ${name} and will be refused — they will NOT fall back to another agent.`));
+        process.exitCode = 1;
+    }
     else if (outcome.kind === 'refused') {
         console.log('');
         console.error(`  ${yellow('⚠')} Signed in, but this workspace refused ${cyan(name)}: ${outcome.reason}`);

package/dist/commands/daemon-cmd.js

@@ -16,6 +16,22 @@ import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { findLiveDaemons, resolveRelayUrlForDaemon } from '../daemon.js';
+import { waitForConnection } from '../connection-ready.js';
+/** Each attempt authenticates over IPC; a PID or greeting alone cannot prove a usable sign-in. */
+export async function waitForLoginConnection() {
+    const { IpcClient } = await import('../ipc-client.js');
+    return waitForConnection(async () => {
+        const client = new IpcClient({ timeout: 1000 });
+        try {
+            await client.connect();
+            const state = await client.call('daemon:session-status', {}, 1000);
+            return { connected: state?.relay?.connected === true, endpoint: state?.relay?.endpoint };
+        }
+        finally {
+            client.disconnect();
+        }
+    }, resolveRelayUrlForDaemon());
+}
 /** dist/daemon-entry.js — sibling of dist/cli.js (this file is dist/commands/). */
 function daemonEntryPath() {
     return join(dirname(fileURLToPath(import.meta.url)), '..', 'daemon-entry.js');
@@ -82,7 +98,7 @@ export async function startHeadlessDaemon(values) {
             const { daemonRpc } = await import('../daemon-client.js');
             let activeRelay = null;
             try {
-                const status = await daemonRpc('daemon:status', {});
+                const status = await daemonRpc('daemon:session-status', {});
                 activeRelay = status?.relay?.endpoint ?? null;
             }
             catch { /* status is advisory; the socket probe already succeeded */ }

package/dist/commands/workspace.js

@@ -26,6 +26,8 @@ import { resolveActiveAgent } from '../agent-state.js';
 import { isAgentRuntime } from '../agent-scope.js';
 import { getTarget } from '../cli-state.js';
 import { attachShellCwd, absorbShellCwd, shellTargetKey } from '../shell-session.js';
+import { planLimitAdvice } from '../limit-advice.js';
+import { resolveAuthOrigin } from '../browser-login.js';
 /** Workspace-agent jobs wait for the server's ceiling (900s) plus the report's tail. */
 export const AGENT_TURN_TIMEOUT_MS = 930_000;
 const AGENT_TURN_ACTIONS = new Set(['agent-prompt', 'agent-turn']);
@@ -1287,6 +1289,16 @@ function printKnownActionAdvice(action, input, result) {
     if (action === 'ticket-get' && result?.code === 'not-found') {
         console.error('  If this key belongs to a document, read it with document-get; ticket-get reads board cards only.');
     }
+    // MCP2-70 / MCP2-71: a plan or account limit says what is true and what to do, in words.
+    if (/-limit-reached$/.test(String(result?.code ?? ''))) {
+        let origin = 'https://www.clearly.sh';
+        try {
+            origin = resolveAuthOrigin().authOrigin;
+        }
+        catch { /* the default web origin */ }
+        for (const line of planLimitAdvice(result, origin))
+            console.error(line);
+    }
 }
 /**
  * Emit navigation hints for common call failures. Agents parse these to
@@ -2463,8 +2475,8 @@ export async function cmdTask(title, values) {
 }
 // ── beehaven doc add <file> — local file → searchable project document ───
 //
-// One-shot: reads a local file, mints a note (note-create) + seeds its body
-// (note-content-seed). Content lands in the workspace SQLite note-content
+// One-shot: reads a local file and creates it through document-create.
+// Content lands in the workspace SQLite note-content
 // table + FTS5 index, so `search-notes` and the cloud agent can retrieve it.
 // This is the DOCUMENT path; `teleport` is the raw-blob (R2) path. Markdown is
 // stored verbatim; code is wrapped in a fenced block (with the language) so it
@@ -2525,16 +2537,14 @@ export async function cmdDocAdd(filePath, values) {
     const title = values.title ||
         (isMarkdown ? raw.match(/^#\s+(.+)$/m)?.[1]?.trim() || fileName : fileName);
     try {
-        const created = await rpcOnce('note-create', {
-            noteData: { projectId: values.project || undefined, title },
-            fileType: 'document',
+        const created = await rpcOnce('document-create', {
+            projectId: values.project || undefined, title, markdown: data,
         }, getTimeout(values));
-        const noteId = created?.noteId || created?.id;
+        assertNoRpcError(created, 'document-create');
+        const noteId = created?.id;
         if (!noteId) {
-            console.error(`  note-create failed: ${JSON.stringify(created)}`);
-            process.exit(1);
+            throw new Error(`document-create failed: ${JSON.stringify(created)}`);
         }
-        await rpcOnce('note-content-seed', { noteId, data, title }, getTimeout(values));
         if (values.json) {
             console.log(JSON.stringify({
                 noteId,

package/dist/connection-ready.js

@@ -0,0 +1,25 @@
+export async function waitForConnection(probe, expectedEndpoint, options = {}) {
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const deadline = now() + (options.timeoutMs ?? 30_000);
+    const normalize = (value) => value.replace(/\/+$/, '');
+    let reason = 'starting';
+    do {
+        try {
+            const state = await probe();
+            if (state.endpoint && normalize(state.endpoint) !== normalize(expectedEndpoint))
+                return { ready: false, reason: 'environment-mismatch' };
+            if (state.connected && state.endpoint && normalize(state.endpoint) === normalize(expectedEndpoint))
+                return { ready: true, reason: 'connected' };
+            reason = 'relay-unavailable';
+        }
+        catch {
+            reason = 'starting';
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            break;
+        await sleep(Math.min(options.pollMs ?? 250, remaining));
+    } while (now() < deadline);
+    return { ready: false, reason };
+}

package/dist/daemon-process.js

@@ -8,8 +8,15 @@
  * daemon. Windows reads command lines from one CIM query instead.
  */
 import { execFileSync } from 'child_process';
+import { fileURLToPath } from 'node:url';
+export const CURRENT_DAEMON_ENTRY = fileURLToPath(new URL('./daemon-entry.js', import.meta.url));
+/** pgrep receives a regex argument, so every metacharacter in a user-chosen path is literal. */
+export function daemonEntryPattern(entry = CURRENT_DAEMON_ENTRY) {
+    const special = '\\.^$*+?()[]{}|';
+    return Array.from(entry, character => special.includes(character) ? '\\' + character : character).join('');
+}
 /**
- * Whether a full command line is a beehaven daemon or CLI process.
+ * Whether a full command line is a beehaven daemon or a legacy CLI-start daemon.
  *
  * Strict two-condition test (unchanged on macOS/Linux):
  *   1. argv[0] is a node/tsx/beehaven binary — not a shell, an editor, a grep, etc.;
@@ -20,14 +27,17 @@ import { execFileSync } from 'child_process';
  * an extension (`"C:\Program Files\nodejs\node.exe" C:\…\daemon-entry.js`). It is reduced to the
  * Unix shape (`C:/Program_Files/nodejs/node …`) so the same two conditions apply, unquoted.
  */
-export function isBeehavenCommandLine(raw, platform = process.platform) {
+export function isBeehavenCommandLine(raw, platform = process.platform, expectedEntry = CURRENT_DAEMON_ENTRY, executable = process.execPath) {
     let cmd = (raw ?? '').trim();
     if (!cmd)
         return false;
+    const ownExecutable = platform !== 'win32' && (cmd.startsWith(executable + ' ') || cmd.startsWith(`"${executable}" `));
+    let tail = ownExecutable ? cmd.slice(cmd.startsWith('"') ? executable.length + 3 : executable.length + 1).trim() : cmd.replace(/^\S+\s*/, '');
     if (platform === 'win32') {
         const m = /^"([^"]*)"\s*(.*)$/s.exec(cmd) ?? /^(\S+)\s*(.*)$/s.exec(cmd);
         if (!m)
             return false;
+        tail = m[2].trim();
         const argv0 = m[1].replace(/\\/g, '/').replace(/\.(exe|cmd)$/i, '').replace(/\s+/g, '_').toLowerCase();
         cmd = `${argv0} ${m[2].replace(/"/g, '')}`.trim();
     }
@@ -35,15 +45,20 @@ export function isBeehavenCommandLine(raw, platform = process.platform) {
     // running a heredoc that contains "node .../cli.js" deeper in its argv doesn't false-positive.
     const argv0Ok = /^(\S*\/)?node(\s|$)/.test(cmd) ||
         /^(\S*\/)?tsx(\s|$)/.test(cmd) ||
-        /^(\S*\/)?beehaven(\s|$)/.test(cmd);
+        /^(\S*\/)?beehaven(\s|$)/.test(cmd) || ownExecutable;
     if (!argv0Ok)
         return false;
-    // ⚠⚠ ON WINDOWS ONLY THE DAEMON ENTRY COUNTS. The `cli.js` patterns below exist for LEGACY daemons
-    // (`node cli.js start`, before daemon-entry.js) — and on macOS `pgrep` never surfaced ordinary CLI
-    // runs anyway (it reads its pattern as a BASIC regex, where `(js|ts)` matches nothing). Windows
-    // lists every node process, so with them a `start --headless` parent waiting for its child was
-    // "another daemon" (the child refused to start — the second Windows CI run), and `stop` would
-    // have killed an agent's in-flight `beehaven call`. There are no legacy Windows daemons to find.
+    const firstArgument = tail.startsWith('"') ? tail.slice(1).split('"')[0] : tail.split(/\s/)[0];
+    if (/^-(?:e|p|ep|pe)$|^--(?:eval|print)(?:=|$)/.test(firstArgument))
+        return false;
+    // A custom installer prefix need not contain the word "beehaven". Trust only this package's
+    // exact entry as the direct script argument; a quoted mention inside `node -e` is not a daemon.
+    const normalize = (s) => platform === 'win32' ? s.replace(/\\/g, '/').toLowerCase() : s;
+    const rest = normalize(tail), entry = normalize(expectedEntry);
+    if ([entry, `"${entry}"`].some(value => rest === value || rest.startsWith(value + ' ')))
+        return true;
+    // Windows has no legacy CLI-start daemons. Unix retains that old start shape, but ordinary
+    // CLI calls and eval/print processes are never daemon candidates on any platform.
     if (platform === 'win32')
         return /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd);
     // Condition 2: a subsequent argument must reference a beehaven script.
@@ -59,8 +74,8 @@ export function isBeehavenCommandLine(raw, platform = process.platform) {
     /[/\\]\.?beehaven([-_]sdk)?[/\\].*daemon-entry\.(js|ts)\b/.test(cmd) ||
         /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]daemon-entry\.js\b/.test(cmd) ||
         // Legacy `cli.js start` — for old bundles pre-dating daemon-entry.js.
-        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)\b/.test(cmd) ||
-        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js\b/.test(cmd) ||
+        /[/\\]\.?beehaven([-_]sdk)?[/\\].*cli\.(js|ts)["']?\s+start(?:\s|$)/.test(cmd) ||
+        /Clearly[^/\\]*\.app[/\\]Contents[/\\]Resources[/\\]beehaven[/\\]cli\.js["']?\s+start(?:\s|$)/.test(cmd) ||
         // Bare `beehaven start` — wrapper already matched argv[0].
         /^(\S*\/)?beehaven\s+start\b/.test(cmd));
 }

package/dist/daemon.js

@@ -14,7 +14,7 @@ import { browsePath } from './file-browser.js';
 import { CloudBeeProxy } from './bee/cloud-proxy.js';
 import { IpcServer, probeIpcSocket } from './ipc-server.js';
 import { ipcSocketPath } from './ipc-path.js';
-import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons } from './daemon-process.js';
+import { isBeehavenCommandLine, windowsNodeProcesses, selectWindowsDaemons, daemonEntryPattern } from './daemon-process.js';
 import { mintIpcAuthTokens, clearIpcAuthToken } from './ipc-auth.js';
 /**
  * What THIS daemon minted, so shutdown can avoid scrubbing a successor's token.
@@ -41,7 +41,7 @@ import { AgentSessions } from './agent-sessions.js';
 import { RELAY_PRESETS, relayUrlFromConfig, resolveRelaySelection } from './relay-presets.js';
 import { readFileSync, existsSync, mkdirSync, mkdtempSync, writeFileSync, readdirSync, chmodSync, unlinkSync, rmSync, } from 'fs';
 import { createHash } from 'crypto';
-import { execFile, execSync, spawn } from 'child_process';
+import { execFile, execFileSync, execSync, spawn } from 'child_process';
 import { homedir, tmpdir } from 'os';
 import { join, dirname, relative } from 'path';
 import { fileURLToPath } from 'url';
@@ -1228,13 +1228,14 @@ export function findLiveDaemons() {
     //    re-validated by isBeehavenProcess so a broad pgrep hit still has
     //    to pass the strict regex check before being considered ours.
     const patterns = [
+        daemonEntryPattern(),
         'beehaven.*daemon-entry\\.(js|ts)',
         'beehaven.*cli\\.(js|ts)',
         'Clearly.*Resources/beehaven',
     ];
     for (const pattern of patterns) {
         try {
-            const out = execSync(`pgrep -f "${pattern}"`, {
+            const out = execFileSync('pgrep', ['-f', pattern], {
                 encoding: 'utf8',
                 stdio: ['pipe', 'pipe', 'pipe'],
             }).trim();

package/dist/limit-advice.js

@@ -0,0 +1,32 @@
+/**
+ * Plain-language advice printed under a plan or account limit refusal from `beehaven call`
+ * (MCP2-70 workspaces, MCP2-71 identities, MCP2-65 per-workspace agents). The refusal JSON is
+ * printed first; these lines say what is true and the one thing to do next. Pure: returns lines.
+ */
+import { upgradeLink } from './agent-limit-refusal.js';
+export function planLimitAdvice(result, origin) {
+    const code = String(result?.code ?? '');
+    if (code === 'workspace-limit-reached') {
+        const owned = Number(result?.current) || 1;
+        return [
+            owned > 1
+                ? `  You own ${owned} workspaces and Free includes 1. Nothing has been removed.`
+                : '  Free includes 1 workspace you own, and you have it. Workspaces you were invited to don\'t count.',
+            `  Upgrade your workspace to create more: ${upgradeLink(origin, result?.upgradeUrl)}`,
+        ];
+    }
+    if (code === 'identity-limit-reached') {
+        return [
+            `  Your account has ${Number(result?.current) || 'the most'} agents, the most one account can have (the same on every plan).`,
+            '  Delete one you no longer use in Agents, or sign in as one you have: beehaven agent list',
+        ];
+    }
+    if (code === 'agent-limit-reached') {
+        return [
+            '  This workspace has all the agents its plan includes. One agent can work from several apps.',
+            '  Use one you have (beehaven agent login <name>), archive one in Agents settings,',
+            `  or upgrade for more agents: ${upgradeLink(origin, result?.upgradeUrl)}`,
+        ];
+    }
+    return [];
+}

package/dist/relay.js

@@ -518,7 +518,16 @@ export class Relay {
                     expiredNoRefresh = true;
             }
         }
-        catch { }
+        catch {
+            // A damaged cached ID token has no decodable exp, but a valid refresh session can still
+            // recover it. Do not strand that account in an unauthenticated reconnect loop. Opaque
+            // self-hosted tokens without a refresh session retain their existing dial behavior.
+            if (this.config.refreshToken) {
+                const refreshed = await this.refreshIdToken();
+                if (refreshed && this.config)
+                    token = this.config.token;
+            }
+        }
         // If the token is already expired AND refresh failed, dialing would just
         // get rejected — spinning the reconnect loop forever with a dead
         // credential (the classic "daemon stuck reconnecting" state). Back off

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beehaven",
-  "version": "0.8.37",
+  "version": "0.8.39",
   "description": "Beehaven CLI — command your Clearly workspace, agents, and canvas from the terminal",
   "private": false,
   "type": "module",

package/scripts/sync-skills.mjs

@@ -47,12 +47,24 @@ const SOURCES = {
   'clearly-init':      'apps/mcp-server/plugin/skills/clearly-init/SKILL.md',
   'clearly-workflows': 'apps/mcp-server/plugin/skills/clearly-workflows/SKILL.md',
   'clearly-artifacts': 'apps/mcp-server/plugin/skills/clearly-artifacts/SKILL.md',
+  // CC2-245 — print and social design, so the CLI teaches the same set as the app.
+  'print-production':  'apps/mcp-server/plugin/skills/print-production/SKILL.md',
+  'social-posts':      'apps/mcp-server/plugin/skills/social-posts/SKILL.md',
 };
 
 let missing = 0;
 const out = join(PKG, 'skills');
 mkdirSync(out, { recursive: true });
 for (const [name, rel] of Object.entries(SOURCES)) {
+  // Standalone package CI has no Clearly monorepo. Its explicitly merged bundle is the input;
+  // still validate every shipped skill and regenerate the same content-hashed manifest below.
+  if (process.env.BEEHAVEN_SKILLS_SNAPSHOT === '1') {
+    if (!existsSync(join(out, name, 'SKILL.md'))) {
+      console.error(`  ✗ ${name}: packaged snapshot missing`);
+      missing++;
+    }
+    continue;
+  }
   const src = join(REPO, rel);
   if (!existsSync(src)) {
     /**

package/skills/clearly-agent/SKILL.md

@@ -190,11 +190,23 @@ Anything you create is stamped `created_by: agent:<your-id>` and born **private*
 - **a SIBLING agent does not**, unless it is shared;
 - **you can see and manage your own**, and you can see your owner's work.
 
-⚠⚠ **FILING INTO A SHARED PROJECT IS THE ONLY SHARING MECHANISM.** There is no per-item ACL. If a
+⚠⚠ **FILING INTO A SHARED PROJECT IS HOW YOU SHARE.** There is no per-item ACL. If a
 teammate or another agent needs your work, move it into a project you both belong to
 (`project-member-add` takes an `agentId`). A project is **open** (all workspace members) or
 **invite-only**; the workspace default is set once in Settings → Workspace → Project access.
 
+Change it on something you made (document, sheet, deck or canvas) with one call, CLI or MCP:
+
+```bash
+beehaven call sharing-set '{"kind":"document","id":"PLA-5420","project":"Agent Work OS — Seed Roadmap"}'
+beehaven call sharing-set '{"kind":"document","id":"PLA-5420","visibility":"workspace"}'   # unfiled, everyone
+beehaven call sharing-set '{"kind":"composition","id":"<canvas id>","project":null}'       # back to Drafts, private
+```
+
+Over MCP: `clearly_edit { target, changes: { sharing: { project?, visibility? } } }`. The reply says
+who can see it now. ⚠ Only on your own work: another agent's (or your owner's) is refused `not-yours`.
+Don't copy a document to share it; the copy splits its history and comments.
+
 ⚠ Creating something does **not** put it in your owner's Recents — that is deliberate. They find it
 in Drafts. Opening it is what makes it recent *for them*.
 

package/skills/clearly-artifacts/SKILL.md

@@ -5,7 +5,7 @@ description: >-
   Put a self-contained interactive HTML page into a Clearly workspace, the way a
   Claude artifact works: an explainer, an animation, a small tool, a calculator, a
   chart that runs. Covers which of the three HTML homes runs scripts (a SITE does,
-  a canvas ARTIFACT card does but cannot be clicked, a NOTE never does), the exact
+  a canvas ARTIFACT card does and is clicked only in Interact mode, a NOTE never does), the exact
   CLI calls, the sandbox limits, updating, filing in a project, how a person opens
   it, and QA. Use when asked to publish, host or add an HTML page, demo or animation
   to the workspace. Triggers: "make an artifact", "publish this HTML", "add this page /
@@ -23,13 +23,14 @@ production hold different workspaces.
 | Home | Make it with | Scripts and CSS animation | Clickable | Search, history | Opens at |
 |---|---|---|---|---|---|
 | **Site** | `compose-upload-init` → `file-teleport-inline` → `compose-upload-finalize` | run | yes | not in `document-search`; no version history; a re-upload overwrites | Recents or project card → `/compositions/detail?id=<id>` |
-| **Canvas artifact** | `canvas-act` `canvas.add-artifact` | run | **no**: the card never takes pointer events, so it pans like a picture | no; it is part of the canvas and is deleted with it | the canvas, `/c/<compositionId>` |
+| **Canvas artifact** | `canvas-act` `canvas.add-artifact` | run | **only in Interact mode**: by default the card takes no pointer events and pans like a picture; the person selects it and presses **Interact** (Done or Esc hands input back to the canvas) | no; it is part of the canvas and is deleted with it | the canvas, `/c/<compositionId>` |
 | **Note** | `document-create {html}`; `page-write` (in-app chat only) | **never**: it opens in the document editor, which drops `<script>`, `<style>` and inline `<svg>` | n/a | yes, both | `/documents/<id>` |
 
 - An interactive page someone opens, clicks through or comes back to is a **site**. This is the
   Claude-artifact equivalent and the default.
 - A page that only needs to be **seen** beside other cards (a looping animation, a live chart in a
-  review board) is a **canvas artifact**. Buttons inside it cannot be pressed.
+  review board) is a **canvas artifact**. Its buttons respond only after the person selects the
+  card and presses Interact, so never make a control the only way to see the content.
 - Prose the team will read, search and edit is a **note**. Never put a script in a note: it
   is stored, and then nothing ever runs it. Editing the note in the app rewrites its body.
 
@@ -99,8 +100,8 @@ artifact card. It copies the entry HTML at that moment: later re-uploads do not
 and the site's other files do not load.
 
 **Connector only (MCP):** no tool makes a site or an artifact. `clearly_file_upload` cannot choose
-a site path, and `clearly_create` stores a document body as markdown. `clearly_canvas_place
-{target, kind:"site", id}` can place a site that already exists. Otherwise, tell the person the
+a site path, and `clearly_create` stores a document body as markdown. `clearly_canvas_add
+{target, ops:[{op:"place", kind:"site", id}]}` can place a site that already exists. Otherwise, tell the person the
 running page needs the CLI.
 
 ## 4. Update, file, link