v0.2.0 — proactive company scope fixes

Fixes a bug that prevented the plugin from starting at all on a real Paperclip instance.

The bug. This plugin is a proactive plugin: its work runs in Socket Mode callbacks, timers and setup() — outside any host-issued invocation. In that context Paperclip gates config.get and secrets.resolve on company scope, resolving it only from an explicit companyId in the call params. The plugin passed it on neither, so Test Connection failed with is not allowed to perform "secrets.resolve": company context is required and the Socket Mode connection never opened.

Fixes

• Config now comes from the host's onConfigChanged push (delivered at startup and on every save, with no RPC) and is cached in the worker; ctx.config.get() is no longer called on any runtime path. Config changes apply live, without a worker restart.
• Every ctx.secrets.resolve call passes { companyId }.
• instanceConfigSchema secret-ref fields accept the { type: "secret_ref", secretId, version } object the settings form stores (also in 0.1.1).
• Single-tenant binding: one worker process is shared by every company that configures a plugin, so the plugin now binds to the first company it is configured for and fails closed on a config for a different company (claimed synchronously, so overlapping pushes can't both bind). Event subscriptions are filtered by that company.
• Config is fully validated and both secrets resolved before any teardown, so a bad save can't drop a working connection.

134 tests.

🤖 Generated with Claude Code