viber-channel 0.8.2 → 0.8.4

package/lib/auth.ts

@@ -33,21 +33,38 @@ export interface AuthJson {
   instance_id?: string;
 }
 
+/**
+ * The environment signal — SINGLE source of truth for every env-dependent
+ * behavior in the channel (auth file, agent-session yield, …). The DEV backend
+ * is the only non-default: anything else (unset / staging / prod) uses the
+ * STAGING defaults, so a missing or ambiguous signal can never accidentally
+ * pull dev behavior into staging. Derived from `VIBER_BASE_URL`, which the
+ * launcher always sets per env.
+ */
+export function isDevBackend(
+  baseUrl: string = process.env.VIBER_BASE_URL ?? "",
+): boolean {
+  return baseUrl.includes("viber-dev");
+}
+
 /**
  * Resolve the auth file path.
  *
- * Defaults to `<cwd>/.viber/auth.json`. The optional `VIBER_AUTH_FILE` env var
- * overrides it — absolute paths are used verbatim, relative paths are resolved
- * against `cwd`. This lets a local launcher point the channel at an alternate
- * credential file (e.g. `.viber/dev.auth.json`) WITHOUT swapping `auth.json`,
- * so the default consumer flow (env var unset) is completely unaffected.
+ * The optional `VIBER_AUTH_FILE` env var overrides everything — absolute paths
+ * verbatim, relative paths resolved against `cwd`. With no override the file is
+ * DERIVED from the environment (single source of truth, {@link isDevBackend}):
+ * the dev backend uses `.viber/dev.auth.json`, everything else defaults to
+ * `.viber/auth.json` (staging). This kills the class of bugs where a dev channel
+ * silently authenticated against the dev backend with STAGING creds (`-32000`)
+ * because only `VIBER_BASE_URL` was set and the auth file defaulted to staging.
  */
 export function authFilePath(cwd: string = process.cwd()): string {
   const override = process.env.VIBER_AUTH_FILE;
   if (override !== undefined && override.trim() !== "") {
     return isAbsolute(override) ? override : join(cwd, override);
   }
-  return join(cwd, ".viber", "auth.json");
+  const file = isDevBackend() ? "dev.auth.json" : "auth.json";
+  return join(cwd, ".viber", file);
 }
 
 export function loadAuth(cwd: string = process.cwd()): AuthJson {

package/lib/bridge_core.ts

@@ -27,7 +27,7 @@ import { buildSseUrl } from "./urls.js";
 import { cfAccessHeaders } from "./cfAccess.js";
 import { sessionFilePath, writeHandle } from "./channel_session.js";
 import type { AuthJson } from "./auth.js";
-import { acquireInstance, registerInstance, instanceKindFromEnv, type AcquiredInstance } from "./instance.js";
+import { acquireInstance, registerInstance, instanceKindFromEnv, maybeAttachTeam, type AcquiredInstance } from "./instance.js";
 import {
 	runPersistentControlStream,
 	sendInstanceHeartbeat,
@@ -897,6 +897,9 @@ export async function acquireBridgeInstance(opts: {
 	process.stderr.write(`${logPrefix} instance: registering fresh bridge instance\n`);
 	const reg = await registerInstance(baseUrl, auth.project_id, auth.project_token, fingerprint, label, instanceKindFromEnv() ?? kind);
 	process.stderr.write(`${logPrefix} instance: registered fresh bridge instance (id=${reg.instance_id})\n`);
+	// #398: best-effort self-attach to VIBER_INSTANCE_TEAM (codex/gemma path; the
+	// two branches above go through acquireInstance which already self-attaches).
+	await maybeAttachTeam(baseUrl, auth.project_id, auth.project_token, fingerprint, reg.instance_id, (m) => process.stderr.write(m));
 	return { instance_token: reg.instance_token, instance_key: reg.instance_id };
 }
 

package/lib/bridge_tool_host.ts

@@ -37,10 +37,14 @@ export type BridgeToolName = (typeof BRIDGE_TOOL_NAMES)[number];
 /** Outbound tools whose SUCCESS suppresses the bridge's final auto-post. */
 const OUTBOUND_TOOLS: ReadonlySet<string> = new Set(["send_message", "message_agent"]);
 
-const TOOL_DEFS = [
+// Exported so tests can assert the send_message/message_agent framing on THIS
+// (codex/gemma) surface independently of the Claude ListTools surface — a future
+// edit must not fix one runtime while breaking the other (#390 codex review).
+export const TOOL_DEFS = [
   {
     name: "send_message",
     description:
+      "Reply to the USER. This is the ONLY way to reach the user — they do NOT see your runtime/stdout, so never answer there. " +
       "Post your reply into the current Viber conversation. `text` is the conversational reply — " +
       "read aloud AND shown as Markdown, so keep it short and natural but use light Markdown (short " +
       "lists, numbered steps, **bold**) for readability; put actions/questions here, visibly. " +
@@ -77,7 +81,7 @@ const TOOL_DEFS = [
   {
     name: "message_agent",
     description:
-      "Send a direct message to another agent. Pass the target agent's instance id " +
+      "Send a direct message to ANOTHER agent — NOT for replying to the user (use send_message for that). Pass the target agent's instance id " +
       "(from list_agents) and the text. Opens or reuses a private 1:1 DM and posts your message; " +
       "the agent's reply arrives back on this channel. Targets are normally same-project; an " +
       "ORCHESTRATOR instance (#307) can also message agents of the owner's other projects. " +

package/lib/channel_instructions.ts

@@ -0,0 +1,43 @@
+// The MCP `instructions` blob served to Claude sessions on the viber-channel
+// server. Extracted into a PURE function so it can be asserted in tests without
+// booting the MCP server (#390 step-03).
+//
+// #369 truncation fix: Claude Code truncates long MCP `instructions`
+// ("…[truncated]") and this blob was ~3 KB → the TAIL was dropped before the
+// agent saw it (that hid the agent's name #328, and threatened the #332 pointer
+// + exit-intent). So: CRITICAL lines are FRONT-LOADED (identity → core reply →
+// actions/questions → anti-deadlock → capabilities → exit) and the nice-to-have
+// style notes live at the tail where a cut is harmless.
+
+/**
+ * Build the MCP `instructions` string.
+ *
+ * @param identityLine the per-session agent identity line (from
+ *   agentIdentityFromEnv()) — "" for JP's own session (no explicit-name flag),
+ *   in which case it is filtered out and the rest of the blob still applies.
+ */
+export function buildChannelInstructions(identityLine: string): string {
+  return [
+    identityLine,
+    // --- critical: front-loaded so truncation can never drop them ---
+    // #390: route the REPLY unambiguously. The <channel> header carries TWO
+    // source= attributes — the first is the MCP server name (always
+    // "viber-channel"), the LAST is meta.source, the real discriminant:
+    // "microphone" = voice, "conversation" = typed UI text (both = the USER),
+    // "agent-dm" = another agent. Naming the real values (not the server name)
+    // avoids the old imprecise "source=viber-channel" cue.
+    'To reply to the USER, ALWAYS use send_message — NEVER write your answer to the terminal / your runtime stdout (the user does not watch it; there may be many terminals). A <channel> event whose metadata source (the last source= attribute) is "microphone" (voice) or "conversation" (typed text) is the user talking to you → reply with send_message. source="agent-dm" is ANOTHER agent → reply with message_agent. send_message = the user; message_agent = other agents ONLY, never the user.',
+    "Your send_message `text` is BOTH read aloud (TTS) AND shown as Markdown — make it natural aloud AND easy to read; lead with the answer, no preamble.",
+    "Put ACTIONS and QUESTIONS in `text`, visibly — never bury them in the artifact. Use light Markdown (short bullet/numbered lists, **bold**) to stay readable; a short spoken list is fine.",
+    // #343 anti-deadlock (hands-free: the user is NOT watching the terminal).
+    "CRITICAL — while this channel is active, NEVER block on a terminal prompt or AskUserQuestion: the user is hands-free and cannot see the terminal, so it deadlocks. Put EVERY question or choice in send_message `text` and take the answer from the next user message (voice or typed).",
+    // #332 discoverability pointer (the how-to lives in the capabilities tool).
+    "To orchestrate or spawn OTHER agents (Codex, Claude, Gemma) on this machine, call the `capabilities` tool for how — only when relevant.",
+    "On exit intent (bye, au revoir, stop) call stop_conversation(), speak a brief farewell, and stop.",
+    // --- nice-to-have style notes (safe near the tail) ---
+    "The `artifact` (format: markdown default, or code/json/html) is for HEAVY/LONG content (big code, large tables, long analyses, JSON, file lists); keep `text` a brief spoken summary that points to it ('details on the side'). Scripts/event handlers are stripped server-side.",
+    "NO EMOJI in `text` (read aloud — an emoji becomes spoken noise). Write identifiers LITERALLY (288, auth.json, viber-dev.dgypx.dev) — never spell out dots/dashes; a lone long token or path is better placed in the artifact.",
+  ]
+    .filter((line) => line.length > 0)
+    .join(" ");
+}

package/lib/instance.ts

@@ -76,6 +76,77 @@ export function instanceKindFromEnv(): string | undefined {
   return raw !== undefined && raw.trim() !== "" ? raw.trim() : undefined;
 }
 
+/**
+ * The DB-backed team this process should join (#398), from `VIBER_INSTANCE_TEAM`
+ * (set by the spawn path — vibe-master's agent_spec). undefined when unset → the
+ * agent joins no team. Mirrors `instanceKindFromEnv`.
+ */
+export function instanceTeamFromEnv(): string | undefined {
+  const raw = process.env.VIBER_INSTANCE_TEAM;
+  return raw !== undefined && raw.trim() !== "" ? raw.trim() : undefined;
+}
+
+/**
+ * POST /api/projects/:id/teams/members — attach this instance to a team by name
+ * (#398). A SEPARATE authorized call AFTER register (the register payload never
+ * carries a client-declared team — same discipline as the orchestrator flag).
+ * Team is project-scoped metadata; the worker upserts it and verifies the
+ * instance belongs to the token's project. Throws InstanceRegisterError on !ok.
+ */
+export async function attachInstanceTeam(
+  baseUrl: string,
+  projectId: number,
+  projectToken: string,
+  fingerprint: string,
+  instanceId: string,
+  team: string,
+): Promise<void> {
+  const resp = await fetch(
+    `${baseUrl}/api/projects/${projectId}/teams/members`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${projectToken}`,
+        "X-Client-Fingerprint": fingerprint,
+        "Content-Type": "application/json",
+        ...cfAccessHeaders(),
+      },
+      body: JSON.stringify({ team, instance_id: instanceId }),
+    },
+  );
+  if (!resp.ok) {
+    const detail = await resp.text().catch(() => "");
+    throw new InstanceRegisterError(resp.status, detail);
+  }
+}
+
+/**
+ * Best-effort self-attach to `VIBER_INSTANCE_TEAM`, run AFTER a successful
+ * register/acquire (#398, R-CLAUDE: called from BOTH acquireInstance — claude/
+ * plain — and acquireBridgeInstance — codex/gemma). No-op when no team is
+ * requested or no server instance_id is known. A failure (legacy worker 404,
+ * validation, network) is logged and swallowed — the agent still works,
+ * un-teamed (forward-compatible). NOT retried.
+ */
+export async function maybeAttachTeam(
+  baseUrl: string,
+  projectId: number,
+  projectToken: string,
+  fingerprint: string,
+  instanceId: string | undefined,
+  log: (msg: string) => void = (m) => process.stderr.write(m),
+): Promise<void> {
+  const team = instanceTeamFromEnv();
+  if (team === undefined || instanceId === undefined) return;
+  try {
+    await attachInstanceTeam(baseUrl, projectId, projectToken, fingerprint, instanceId, team);
+    log(`[viber-channel] team: attached instance ${instanceId.slice(0, 8)} to team "${team}"\n`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log(`[viber-channel] team: self-attach to "${team}" failed (non-fatal): ${msg}\n`);
+  }
+}
+
 export interface AcquiredInstance {
   instance_token: string;
   /**
@@ -116,6 +187,10 @@ export async function acquireInstance(
   log: (msg: string) => void = (m) => process.stderr.write(m),
   cwd: string = process.cwd(),
 ): Promise<AcquiredInstance> {
+  // Resolve the identity into `result` (one of the four paths), then run the
+  // #398 team self-attach ONCE at the single exit — covers every path (incl. the
+  // claude/plain register paths) without scattering the call (R-CLAUDE).
+  let result: AcquiredInstance;
   const envToken = process.env.VIBER_INSTANCE_TOKEN;
   if (envToken !== undefined && envToken.trim() !== "") {
     const token = envToken.trim();
@@ -123,42 +198,44 @@ export async function acquireInstance(
     const realId = envId !== undefined && envId.trim() !== "" ? envId.trim() : undefined;
     const key = realId ?? token;
     log(`[viber-channel] instance: using VIBER_INSTANCE_TOKEN (env-injected)\n`);
-    return { instance_token: token, instance_key: key, instance_id: realId };
-  }
-
-  const envLabel = process.env.VIBER_CHANNEL_LABEL;
-  if (envLabel !== undefined && envLabel.trim() !== "") {
-    const label = envLabel.trim();
-    log(`[viber-channel] instance: registering fresh labelled instance "${label}"\n`);
-    const reg = await registerInstance(
-      baseUrl,
-      auth.project_id,
-      auth.project_token,
-      fingerprint,
-      label,
-      instanceKindFromEnv(),
-    );
-    return { instance_token: reg.instance_token, instance_key: reg.instance_id, instance_id: reg.instance_id };
-  }
-
-  if (auth.instance_token !== undefined && auth.instance_token.trim() !== "") {
-    const realId =
-      auth.instance_id !== undefined && auth.instance_id.trim() !== "" ? auth.instance_id : undefined;
-    const key = realId ?? auth.instance_token;
-    log(`[viber-channel] instance: reusing persisted instance_token (id=${auth.instance_id ?? "?"})\n`);
-    return { instance_token: auth.instance_token, instance_key: key, instance_id: realId };
+    result = { instance_token: token, instance_key: key, instance_id: realId };
+  } else {
+    const envLabel = process.env.VIBER_CHANNEL_LABEL;
+    if (envLabel !== undefined && envLabel.trim() !== "") {
+      const label = envLabel.trim();
+      log(`[viber-channel] instance: registering fresh labelled instance "${label}"\n`);
+      const reg = await registerInstance(
+        baseUrl,
+        auth.project_id,
+        auth.project_token,
+        fingerprint,
+        label,
+        instanceKindFromEnv(),
+      );
+      result = { instance_token: reg.instance_token, instance_key: reg.instance_id, instance_id: reg.instance_id };
+    } else if (auth.instance_token !== undefined && auth.instance_token.trim() !== "") {
+      const realId =
+        auth.instance_id !== undefined && auth.instance_id.trim() !== "" ? auth.instance_id : undefined;
+      const key = realId ?? auth.instance_token;
+      log(`[viber-channel] instance: reusing persisted instance_token (id=${auth.instance_id ?? "?"})\n`);
+      result = { instance_token: auth.instance_token, instance_key: key, instance_id: realId };
+    } else {
+      log(`[viber-channel] instance: none found — registering a new one via the project_token\n`);
+      const reg = await registerInstance(
+        baseUrl,
+        auth.project_id,
+        auth.project_token,
+        fingerprint,
+        undefined,
+        instanceKindFromEnv(),
+      );
+      persistInstanceCredentials(authFilePath(cwd), reg.instance_id, reg.instance_token, log);
+      log(`[viber-channel] instance: registered + persisted (id=${reg.instance_id})\n`);
+      result = { instance_token: reg.instance_token, instance_key: reg.instance_id, instance_id: reg.instance_id };
+    }
   }
 
-  log(`[viber-channel] instance: none found — registering a new one via the project_token\n`);
-  const reg = await registerInstance(
-    baseUrl,
-    auth.project_id,
-    auth.project_token,
-    fingerprint,
-    undefined,
-    instanceKindFromEnv(),
-  );
-  persistInstanceCredentials(authFilePath(cwd), reg.instance_id, reg.instance_token, log);
-  log(`[viber-channel] instance: registered + persisted (id=${reg.instance_id})\n`);
-  return { instance_token: reg.instance_token, instance_key: reg.instance_id, instance_id: reg.instance_id };
+  // #398: best-effort self-attach to VIBER_INSTANCE_TEAM (no-op when unset).
+  await maybeAttachTeam(baseUrl, auth.project_id, auth.project_token, fingerprint, result.instance_id, log);
+  return result;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-channel.ts

@@ -42,7 +42,7 @@ import {
 } from "./lib/conversation.ts";
 import { startInstanceHeartbeat } from "./lib/heartbeat.ts";
 import { startParentWatchdog } from "./lib/parent_watchdog.ts";
-import { acquireInstance, registerInstance } from "./lib/instance.ts";
+import { acquireInstance, maybeAttachTeam, registerInstance } from "./lib/instance.ts";
 import {
   runPersistentControlStream,
   sendInstanceHeartbeat,
@@ -55,6 +55,7 @@ import {
 } from "./lib/token_refresh.ts";
 import { awaitStableStartup } from "./lib/startup_gate.ts";
 import { agentIdentityFromEnv } from "./lib/bridge_core.ts";
+import { buildChannelInstructions } from "./lib/channel_instructions.ts";
 import { warnIfStale } from "./lib/version_check.ts";
 import { capabilitiesText } from "./lib/capabilities.ts";
 
@@ -70,7 +71,17 @@ import { capabilitiesText } from "./lib/capabilities.ts";
   // loads in the same session with the same env; instead of racing it for the
   // channel lock, it bows out deterministically here. Normal sessions
   // (no VIBER_CHANNEL_AGENT_SESSION) are unaffected.
+  //
+  // BUT the yield is a STAGING/PROD-only behavior: the plugin channel only runs
+  // there (it is disabled in the Viber dev repo, #365). On the DEV backend there
+  // is NO plugin to yield to, so yielding = no channel at all (`-32000`, no
+  // registration). Derive this from the environment (single source of truth,
+  // isDevBackend) instead of relying on VIBER_CHANNEL_AGENT_SESSION not leaking
+  // from the parent shell into the spawned dev terminal (the real bug: that var
+  // leaked and terminal.ts never cleared it, so the dev channel silently bowed
+  // out). Default (non-dev) behavior is unchanged.
   if (
+    !isDevBackend() &&
     process.env.VIBER_CHANNEL_AGENT_SESSION === "1" &&
     process.env.VIBER_CHANNEL_PLUGIN !== "1"
   ) {
@@ -306,7 +317,12 @@ process.stdin.on("end", () => {
 
 // ---- Auth from .viber/auth.json ----
 
-import { authFilePath, loadAuth, persistInstanceCredentials } from "./lib/auth.ts";
+import {
+  authFilePath,
+  isDevBackend,
+  loadAuth,
+  persistInstanceCredentials,
+} from "./lib/auth.ts";
 import { handleConversationTokenExpired } from "./lib/channel_errors.ts";
 import { buildSseUrl } from "./lib/urls.ts";
 
@@ -353,32 +369,10 @@ const mcp = new Server(
       experimental: { "claude/channel": {} },
       tools: {},
     },
-    // #369 truncation fix: Claude Code truncates long MCP `instructions`
-    // ("…[truncated]") and this blob was ~3 KB → the TAIL was dropped before the
-    // agent saw it (that hid the agent's name #328, and threatened the #332
-    // pointer + exit-intent). So: CRITICAL lines are FRONT-LOADED (identity →
-    // core reply → actions/questions → anti-deadlock → capabilities → exit) and
-    // the nice-to-have style notes live at the tail where a cut is harmless.
-    // Condensed vs the old prose (same substance — reviewed). Identity is "" for
-    // JP's own session (no explicit-name flag) → the identity LINE is filtered
-    // out for him; the rest of the (now shorter, reordered) blob applies to every
-    // session including his.
-    instructions: [
-      agentIdentityFromEnv(),
-      // --- critical: front-loaded so truncation can never drop them ---
-      'Voice transcripts arrive as <channel source="viber-channel"> events (the user\'s microphone speech). Reply with send_message. The `text` is BOTH read aloud (TTS) AND shown as Markdown — make it natural aloud AND easy to read; lead with the answer, no preamble.',
-      "Put ACTIONS and QUESTIONS in `text`, visibly — never bury them in the artifact. Use light Markdown (short bullet/numbered lists, **bold**) to stay readable; a short spoken list is fine.",
-      // #343 anti-deadlock (hands-free: the user is NOT watching the terminal).
-      "CRITICAL — while this channel is active, NEVER block on a terminal prompt or AskUserQuestion: the user is hands-free and cannot see the terminal, so it deadlocks. Put EVERY question or choice in send_message `text` and take the answer from the next voice transcript.",
-      // #332 discoverability pointer (the how-to lives in the capabilities tool).
-      "To orchestrate or spawn OTHER agents (Codex, Claude, Gemma) on this machine, call the `capabilities` tool for how — only when relevant.",
-      "On exit intent (bye, au revoir, stop) call stop_conversation(), speak a brief farewell, and stop.",
-      // --- nice-to-have style notes (safe near the tail) ---
-      "The `artifact` (format: markdown default, or code/json/html) is for HEAVY/LONG content (big code, large tables, long analyses, JSON, file lists); keep `text` a brief spoken summary that points to it ('details on the side'). Scripts/event handlers are stripped server-side.",
-      "NO EMOJI in `text` (read aloud — an emoji becomes spoken noise). Write identifiers LITERALLY (288, auth.json, viber-dev.dgypx.dev) — never spell out dots/dashes; a lone long token or path is better placed in the artifact.",
-    ]
-      .filter((line) => line.length > 0)
-      .join(" "),
+    // The blob lives in a PURE builder (lib/channel_instructions.ts) so it can be
+    // asserted in tests without booting the server (#390). Identity is "" for JP's
+    // own session (no explicit-name flag) → filtered out; the rest applies to all.
+    instructions: buildChannelInstructions(agentIdentityFromEnv()),
   }
 );
 
@@ -389,6 +383,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: "send_message",
       description:
+        "Reply to the USER. This is how you talk to the user — NOT the terminal / your stdout (they do not watch it). Calling this IS your reply for the turn. " +
         "Send a message into the Viber conversation this channel is bound to. " +
         "`text` is the conversational reply — it is BOTH read aloud (TTS) AND rendered as Markdown on screen, so keep it short and natural but use light Markdown (short bullet/numbered lists, **bold**) when it aids readability. Put any ACTIONS or QUESTIONS for the user here, visibly. " +
         "`artifact` is optional and carries HEAVY/LONG content (big code, large tables, long analyses, JSON, sanitized HTML) rendered in a side viewer; when used, keep `text` a brief summary that points to it. " +
@@ -444,7 +439,7 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: "message_agent",
       description:
-        "Send a direct message to another agent (#288). " +
+        "Send a direct message to ANOTHER agent (#288) — NOT for replying to the user (use send_message for that). " +
         "Pass the target agent's instance id (from list_agents, or the from_instance_id of a DM you received) " +
         "and the message text. Opens or reuses a private 1:1 DM with that agent and posts your message; " +
         "the agent's reply arrives back on this channel tagged source=agent-dm. " +
@@ -698,6 +693,8 @@ try {
       persistInstanceCredentials(authFilePath(), reg.instance_id, reg.instance_token);
       instanceToken = reg.instance_token;
       OWN_INSTANCE_ID = reg.instance_id;
+      // #398: re-attach the fresh (post-revocation) instance to its team.
+      await maybeAttachTeam(BASE_URL, auth.project_id, auth.project_token, auth.client_fingerprint, reg.instance_id);
       SESSION_FILE = sessionFilePath(LOCK_BASE_URL, reg.instance_id, LOCK_DIR);
       minted = await acquireConversation(
         SESSION_FILE,

package/viber-codex-bridge.ts

@@ -18,7 +18,7 @@ import {
 } from "./lib/conversation.ts";
 import { sessionFilePath, writeHandle } from "./lib/channel_session.ts";
 import { clientFingerprint } from "./lib/fingerprint.ts";
-import { acquireInstance, instanceKindFromEnv, registerInstance } from "./lib/instance.ts";
+import { acquireInstance, instanceKindFromEnv, maybeAttachTeam, registerInstance } from "./lib/instance.ts";
 import {
   acquireBridgeLock as coreAcquireBridgeLock,
   agentIdentityFromEnv,
@@ -820,6 +820,9 @@ async function acquireBridgeInstance(
   process.stderr.write("[viber-codex-bridge] instance: registering fresh bridge instance\n");
   const reg = await registerInstance(baseUrl, auth.project_id, auth.project_token, fingerprint, label, instanceKindFromEnv() ?? "codex");
   process.stderr.write(`[viber-codex-bridge] instance: registered fresh bridge instance (id=${reg.instance_id})\n`);
+  // #398 (R-CODEX-FRESH): self-attach here too so codex is teamed structurally,
+  // not only via the VIBER_INSTANCE_TOKEN branch above (parity with claude).
+  await maybeAttachTeam(baseUrl, auth.project_id, auth.project_token, fingerprint, reg.instance_id);
   return { instance_token: reg.instance_token, instance_key: reg.instance_id };
 }
 
@@ -885,6 +888,8 @@ async function acquireTargetConversation(
       const reg = await registerInstance(BASE_URL, auth.project_id, auth.project_token, fingerprint, label, instanceKindFromEnv() ?? "codex");
       instanceToken = reg.instance_token;
       instanceKey = reg.instance_id;
+      // #398: re-attach the fresh (post-revocation) codex instance to its team.
+      await maybeAttachTeam(BASE_URL, auth.project_id, auth.project_token, fingerprint, reg.instance_id);
       // Identity changed → re-key the lock onto the new instance. Acquire the new
       // lock BEFORE releasing the old one: if acquisition throws, the old lock is
       // still held and the outer catch releases exactly it (no dangling reference).