@parall/cli 1.55.3 → 1.55.4

package/dist/commands/profile.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerProfileCommands(program: Command): void;
+//# sourceMappingURL=profile.d.ts.map

package/dist/commands/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/commands/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QA8GvD"}

package/dist/commands/profile.js

@@ -0,0 +1,114 @@
+import { readFileSync } from 'node:fs';
+import { resolveCredentials } from '../lib/client.js';
+import { printJson, printError } from '../lib/output.js';
+// Profile commands follow the platform's uniform permission loop: `set` calls
+// the ATOMIC endpoints directly. Callers with edit power (humans on personal
+// keys) mutate immediately; a denied caller (an agent editing itself) gets the
+// structured 403 whose printed `Request approval:` command carries the exact
+// payload that was attempted — running it files the proposal for a human to
+// decide. There is no separate "propose" verb.
+export function registerProfileCommands(program) {
+    const profile = program.command('profile').description('Read and edit your profile');
+    profile
+        .command('show')
+        .description('Show your identity, org profile, Instructions and manager')
+        .action(async () => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const me = await client.getMe();
+            const result = { user: me };
+            try {
+                result.org_profile = await client.getMemberProfile(orgId, me.id);
+            }
+            catch {
+                /* display-only enrichment */
+            }
+            if (me.type === 'agent') {
+                try {
+                    result.instructions = await client.getAgentInstructions(orgId, me.id);
+                }
+                catch {
+                    /* not readable */
+                }
+                try {
+                    result.manager = await client.getAgentManager(orgId, me.id);
+                }
+                catch {
+                    /* not readable */
+                }
+            }
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    profile
+        .command('set')
+        .description('Edit your profile (title/about, Instructions, display name). If you lack permission, the error prints a ready-made approval request carrying exactly what you tried to write.')
+        .option('--title <text>', 'Org-profile title')
+        .option('--about <text>', 'Org-profile about/description')
+        .option('--instructions <text>', 'Full replacement Instructions')
+        .option('--instructions-file <path>', 'Read replacement Instructions from a file')
+        .option('--display-name <name>', 'Display name')
+        .action(async (opts) => {
+        if (opts.instructions !== undefined && opts.instructionsFile !== undefined) {
+            printError(new Error('--instructions and --instructions-file are mutually exclusive'));
+        }
+        const wantsProfile = opts.title !== undefined || opts.about !== undefined;
+        const instructionsBody = opts.instructions ??
+            (opts.instructionsFile ? readFileSync(opts.instructionsFile, 'utf8') : undefined);
+        if (!wantsProfile && instructionsBody === undefined && opts.displayName === undefined) {
+            printError(new Error('Nothing to change. Provide --title/--about, --instructions(-file), or --display-name.'));
+        }
+        const { client, orgId } = resolveCredentials();
+        const me = await client.getMe().catch((err) => printError(err));
+        const applied = {};
+        // Field groups apply independently, in order; the first denial exits
+        // with the prefilled proposal command for THAT group.
+        if (wantsProfile) {
+            // Read-modify-write like any client: a missing profile row is a
+            // successful empty read at version 0. Unspecified fields keep their
+            // current value so the write (and any resulting proposal) is always
+            // the full final state.
+            const current = await client.getMemberProfile(orgId, me.id).catch((err) => printError(err));
+            const body = {
+                title: opts.title ?? current.title,
+                description: opts.about ?? current.description,
+                expected_version: current.profile_version,
+            };
+            try {
+                applied.org_profile = await client.updateMemberProfile(orgId, me.id, body);
+            }
+            catch (err) {
+                printError(err, body);
+            }
+        }
+        if (instructionsBody !== undefined) {
+            const current = await client
+                .getAgentInstructions(orgId, me.id)
+                .catch((err) => printError(err));
+            const body = { instructions: instructionsBody, expected_version: current.version };
+            try {
+                applied.instructions = await client.updateAgentInstructions(orgId, me.id, body);
+            }
+            catch (err) {
+                printError(err, body);
+            }
+        }
+        if (opts.displayName !== undefined) {
+            try {
+                applied.user = await client.updateMe({ display_name: opts.displayName });
+            }
+            catch (err) {
+                // The identity proposal needs the CAS base (name at filing time),
+                // which the direct PATCH body does not carry — prefill it here.
+                printError(err, {
+                    display_name: opts.displayName,
+                    previous_display_name: me.display_name,
+                });
+            }
+        }
+        printJson(applied);
+    });
+}

package/dist/commands/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/commands/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QA8FvD"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/commands/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAyOvD"}

package/dist/commands/projects.js

@@ -1,5 +1,6 @@
 import { resolveCredentials } from '../lib/client.js';
 import { printJson, printError, stripPrllScheme } from '../lib/output.js';
+const VISIBILITY_HELP = 'public (any org member self-joins), restricted (join by approved request), or private (invite only); reading requires roster membership, with org owners/admins implicit';
 export function registerProjectCommands(program) {
     const projects = program.command('projects').description('Manage projects');
     projects
@@ -35,7 +36,7 @@ export function registerProjectCommands(program) {
         .requiredOption('--name <name>', 'Project name')
         .requiredOption('--key <key>', 'Project key')
         .option('--description <text>', 'Project description')
-        .option('--visibility <visibility>', 'public (whole org) or private (roster only)')
+        .option('--visibility <visibility>', VISIBILITY_HELP)
         .option('--color <hex>', 'Project color (hex)')
         .action(async (opts) => {
         try {
@@ -60,7 +61,7 @@ export function registerProjectCommands(program) {
         .argument('<projectId>', 'Project ID')
         .option('--name <name>', 'Project name')
         .option('--description <text>', 'Project description')
-        .option('--visibility <visibility>', 'public (whole org) or private (roster only)')
+        .option('--visibility <visibility>', VISIBILITY_HELP)
         .option('--color <hex>', 'Project color (hex)')
         .option('--status <status>', 'Project status')
         .action(async (projectId, opts) => {
@@ -102,4 +103,133 @@ export function registerProjectCommands(program) {
             printError(err);
         }
     });
+    projects
+        .command('library')
+        .description('Browse joinable projects (public + restricted) with your admission state. If task creation fails with no available projects, start here.')
+        .action(async () => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getProjectLibrary(orgId);
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    projects
+        .command('join')
+        .description('Join a public project immediately (restricted projects need `projects request-join`)')
+        .argument('<projectId>', 'Project ID')
+        .action(async (projectId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.joinProject(orgId, stripPrllScheme(projectId));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    projects
+        .command('request-join')
+        .description('File a join request for a restricted project; a project manager approves it')
+        .argument('<projectId>', 'Project ID')
+        .option('--cancel', 'Withdraw your pending join request instead')
+        .action(async (projectId, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const id = stripPrllScheme(projectId);
+            if (opts.cancel) {
+                await client.cancelProjectJoinRequest(orgId, id);
+                printJson({ cancelled: id });
+                return;
+            }
+            const result = await client.createProjectJoinRequest(orgId, id);
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    projects
+        .command('join-requests')
+        .description('List pending join requests for a project (manager standing required)')
+        .argument('<projectId>', 'Project ID')
+        .action(async (projectId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.listProjectJoinRequests(orgId, stripPrllScheme(projectId));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    const members = projects.command('members').description('Manage a project roster');
+    members
+        .command('list')
+        .description('List roster members (readable by anyone who can read the project)')
+        .argument('<projectId>', 'Project ID')
+        .action(async (projectId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getProjectMembers(orgId, stripPrllScheme(projectId));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('add')
+        .description('Add a user or team to the roster (manager standing required)')
+        .argument('<projectId>', 'Project ID')
+        .argument('<subject>', 'User ID (usr_...) or team ID (team_...)')
+        .option('--role <role>', 'member or manager', 'member')
+        .action(async (projectId, subject, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.addProjectMember(orgId, stripPrllScheme(projectId), {
+                subject: stripPrllScheme(subject),
+                role: opts.role,
+            });
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('remove')
+        .description('Remove a roster entry (manager standing required)')
+        .argument('<projectId>', 'Project ID')
+        .argument('<subject>', 'User ID or team ID')
+        .action(async (projectId, subject) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const id = stripPrllScheme(projectId);
+            const sub = stripPrllScheme(subject);
+            await client.removeProjectMember(orgId, id, sub);
+            printJson({ removed: sub, project: id });
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('set-role')
+        .description('Change a roster entry role (manager standing required)')
+        .argument('<projectId>', 'Project ID')
+        .argument('<subject>', 'User ID or team ID')
+        .requiredOption('--role <role>', 'member or manager')
+        .action(async (projectId, subject, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.updateProjectMember(orgId, stripPrllScheme(projectId), stripPrllScheme(subject), { role: opts.role });
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
 }

package/dist/commands/refs.d.ts

@@ -4,8 +4,9 @@ import type { Command } from 'commander';
  * none. --strict forces none and cannot be combined with --from; non-message
  * runtime triggers are never accepted as message authority.
  */
-export declare function buildResolveRefsOptions(explicitFrom: string | undefined, triggerMessageId: string | undefined, strict?: boolean): {
-    sourceMessageId: string;
+export declare function buildResolveRefsOptions(explicitFrom: string | undefined, triggerMessageId: string | undefined, strict?: boolean, full?: boolean): {
+    sourceMessageId?: string;
+    full?: boolean;
 } | undefined;
 /** Build the SDK ref-graph params from the positional URI + CLI flags. */
 export declare function buildRefGraphParams(uri: string, opts: {

package/dist/commands/refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/commands/refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,MAAM,UAAQ,GACb;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAqBzC;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOjC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QAsEnD"}
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/commands/refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,MAAM,UAAQ,EACd,IAAI,UAAQ,GACX;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAsB1D;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOjC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QA0EnD"}

package/dist/commands/refs.js

@@ -5,28 +5,30 @@ import { ensurePrllScheme, parsePositiveInt, printError, printJson, stripPrllSch
  * none. --strict forces none and cannot be combined with --from; non-message
  * runtime triggers are never accepted as message authority.
  */
-export function buildResolveRefsOptions(explicitFrom, triggerMessageId, strict = false) {
+export function buildResolveRefsOptions(explicitFrom, triggerMessageId, strict = false, full = false) {
     const explicit = explicitFrom?.trim();
     if (strict && explicit) {
         throw new Error('--strict cannot be combined with --from');
     }
     if (strict)
-        return undefined;
+        return full ? { full: true } : undefined;
     if (explicit) {
         const sourceMessageId = stripPrllScheme(explicit);
         if (!sourceMessageId.startsWith('msg_')) {
             throw new Error('--from must be a message ID (msg_...) or prll://msg_... URI');
         }
-        return { sourceMessageId };
+        return full ? { sourceMessageId, full: true } : { sourceMessageId };
     }
     // Typed task dispatches can carry a task ID in trigger_message_id. Only a
     // real message can grant the server's cross-chat reference access; omitting
     // non-message triggers preserves the normal membership-filtered resolve.
     const trigger = triggerMessageId?.trim();
     if (!trigger)
-        return undefined;
+        return full ? { full: true } : undefined;
     const sourceMessageId = stripPrllScheme(trigger);
-    return sourceMessageId.startsWith('msg_') ? { sourceMessageId } : undefined;
+    if (!sourceMessageId.startsWith('msg_'))
+        return full ? { full: true } : undefined;
+    return full ? { sourceMessageId, full: true } : { sourceMessageId };
 }
 /** Build the SDK ref-graph params from the positional URI + CLI flags. */
 export function buildRefGraphParams(uri, opts) {
@@ -45,11 +47,15 @@ export function registerRefCommands(program) {
         .description('Batch resolve prll:// URIs to entity metadata')
         .option('--from <messageId>', 'Forwarding message for cross-chat access (defaults to trigger)')
         .option('--strict', 'Ignore runtime trigger and enforce direct membership checks')
+        .option('--full', 'Return complete text for authorized message references')
         .action(async (uris, opts) => {
         try {
             const { client, orgId } = resolveCredentials();
             const runtime = resolveRuntimeContext();
-            const result = await client.resolveRefs(orgId, uris, buildResolveRefsOptions(opts.from, runtime.triggerMessageId, opts.strict));
+            // Normalize schemeless args (msg_x, cht_x#range=…) like `refs graph`
+            // does: the server drops non-prll URIs without an error, so a raw id
+            // would silently resolve to nothing.
+            const result = await client.resolveRefs(orgId, uris.map(ensurePrllScheme), buildResolveRefsOptions(opts.from, runtime.triggerMessageId, opts.strict, opts.full));
             printJson(result);
         }
         catch (err) {

package/dist/commands/tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgEpC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;;;;;;;;;;;GAaA;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;;YAS0B,iBAAiB,CAAC,QAAQ,CAAC;cACvB,iBAAiB,CAAC,UAAU,CAAC;;;;;;;;GAS3D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QA2WpD"}
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../src/commands/tasks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiEpC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;;;;;;;;;;;GAaA;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;;YAS0B,iBAAiB,CAAC,QAAQ,CAAC;cACvB,iBAAiB,CAAC,UAAU,CAAC;;;;;;;;GAS3D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAkXpD"}

package/dist/commands/tasks.js

@@ -1,4 +1,5 @@
 import { ApiError } from '@parall/sdk';
+import { createHash } from 'node:crypto';
 import { resolveCredentials, resolveTypedDispatchBinding } from '../lib/client.js';
 import { printJson, printError, printRefHint, stripPrllScheme } from '../lib/output.js';
 function stripUndefined(obj) {
@@ -201,10 +202,18 @@ export function registerTaskCommands(program) {
             const binding = resolveTypedDispatchBinding(taskId);
             const req = { ...data };
             if (binding) {
-                req.dispatch_lane = binding.lane;
+                if (binding.lane)
+                    req.dispatch_lane = binding.lane;
                 req.dispatch_event_id = binding.dispatchEventId;
-                if (binding.effectKey)
-                    req.dispatch_effect_key = binding.effectKey;
+                if (binding.generation !== undefined)
+                    req.dispatch_generation = binding.generation;
+                if (binding.effectKey) {
+                    req.dispatch_effect_key = binding.lane
+                        ? binding.effectKey
+                        : // Converged: content-address the key so a same-payload retry
+                            // replays idempotently and a different update mints a new key.
+                            `${binding.effectKey}:${createHash('sha256').update(JSON.stringify(data)).digest('hex').slice(0, 12)}`;
+                }
             }
             const result = await client.updateTask(orgId, taskId, req);
             if (binding?.effectKey) {

package/dist/commands/teams.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerTeamCommands(program: Command): void;
+//# sourceMappingURL=teams.d.ts.map

package/dist/commands/teams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../src/commands/teams.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAiGpD"}

package/dist/commands/teams.js

@@ -0,0 +1,102 @@
+import { resolveCredentials } from '../lib/client.js';
+import { printJson, printError, stripPrllScheme } from '../lib/output.js';
+// Teams are pure permission rosters (ACL subjects for wiki/project ACLs);
+// server-side authorization decides who may mutate them — the CLI only
+// exposes the same surface the web Teams settings use.
+export function registerTeamCommands(program) {
+    const teams = program.command('teams').description('Manage permission teams');
+    teams
+        .command('list')
+        .description('List teams in the organization')
+        .action(async () => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getTeams(orgId);
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    teams
+        .command('get')
+        .description('Get a team by ID')
+        .argument('<teamId>', 'Team ID')
+        .action(async (teamId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getTeam(orgId, stripPrllScheme(teamId));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    const members = teams.command('members').description('Manage a team roster');
+    members
+        .command('list')
+        .description('List team members')
+        .argument('<teamId>', 'Team ID')
+        .action(async (teamId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            const result = await client.getTeamMembers(orgId, stripPrllScheme(teamId));
+            printJson(result);
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('add')
+        .description('Add a member (team manager or org admin)')
+        .argument('<teamId>', 'Team ID')
+        .argument('<userId>', 'User ID (usr_...)')
+        .option('--role <role>', 'member or manager', 'member')
+        .action(async (teamId, userId, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            await client.addTeamMember(orgId, stripPrllScheme(teamId), {
+                user_id: stripPrllScheme(userId),
+                role: opts.role,
+            });
+            printJson({ added: stripPrllScheme(userId), team: stripPrllScheme(teamId) });
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('remove')
+        .description('Remove a member (team manager or org admin)')
+        .argument('<teamId>', 'Team ID')
+        .argument('<userId>', 'User ID')
+        .action(async (teamId, userId) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            await client.removeTeamMember(orgId, stripPrllScheme(teamId), stripPrllScheme(userId));
+            printJson({ removed: stripPrllScheme(userId), team: stripPrllScheme(teamId) });
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+    members
+        .command('set-role')
+        .description('Change a member role (org admin; managers manage plain members only)')
+        .argument('<teamId>', 'Team ID')
+        .argument('<userId>', 'User ID')
+        .requiredOption('--role <role>', 'member or manager')
+        .action(async (teamId, userId, opts) => {
+        try {
+            const { client, orgId } = resolveCredentials();
+            await client.updateTeamMember(orgId, stripPrllScheme(teamId), stripPrllScheme(userId), {
+                role: opts.role,
+            });
+            printJson({ updated: stripPrllScheme(userId), role: opts.role });
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
+}

package/dist/commands/wechat.d.ts

@@ -7,9 +7,10 @@ import { Command } from 'commander';
  * performs the vendor call in-process.
  *
  * Verb surface = the vendor's in-scope interface aggregated: postText
- * (send), fetchContactsList + getBriefInfo + getChatroomInfo (contacts),
- * getProfile (profile), checkOnline (status). Every verb renders
- * agent-readable text by default and `--json` for machine output.
+ * (send), platform-retained context (history), fetchContactsList +
+ * getBriefInfo + getChatroomInfo (contacts), getProfile (profile),
+ * checkOnline (status). History always emits its stable page JSON; the other
+ * verbs render agent-readable text by default and accept `--json`.
  *
  * INTERNAL research preview: the capability is flag-gated to the internal
  * org. Design: docs/engineering-design/wechat-channel-design.md §3, §4.

package/dist/commands/wechat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wechat.d.ts","sourceRoot":"","sources":["../../src/commands/wechat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,QAwItD"}
+{"version":3,"file":"wechat.d.ts","sourceRoot":"","sources":["../../src/commands/wechat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,QA0KtD"}

package/dist/commands/wechat.js

@@ -9,9 +9,10 @@ import { resolveMessageText, TEXT_FILE_OPTION_DESC, TEXT_OPTION_DESC } from '../
  * performs the vendor call in-process.
  *
  * Verb surface = the vendor's in-scope interface aggregated: postText
- * (send), fetchContactsList + getBriefInfo + getChatroomInfo (contacts),
- * getProfile (profile), checkOnline (status). Every verb renders
- * agent-readable text by default and `--json` for machine output.
+ * (send), platform-retained context (history), fetchContactsList +
+ * getBriefInfo + getChatroomInfo (contacts), getProfile (profile),
+ * checkOnline (status). History always emits its stable page JSON; the other
+ * verbs render agent-readable text by default and accept `--json`.
  *
  * INTERNAL research preview: the capability is flag-gated to the internal
  * org. Design: docs/engineering-design/wechat-channel-design.md §3, §4.
@@ -52,6 +53,33 @@ export function registerWechatCommands(program) {
             printError(err);
         }
     });
+    wechat
+        .command('history')
+        .description('Read platform-retained context for a WeChat DM or group')
+        .requiredOption('--conversation <id>', 'Vendor-native conversation id (a friend wxid, or a room id ending in @chatroom)')
+        .option('--before <messageId>', 'Read messages strictly older than this external message id')
+        .option('--since <time>', 'Inclusive lower bound: RFC3339 timestamp or YYYY-MM-DD')
+        .option('--limit <n>', 'Page size (default 20, max 100)')
+        .action(async (opts) => {
+        try {
+            let limit;
+            if (opts.limit !== undefined) {
+                limit = Number(opts.limit);
+                if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+                    throw new Error('--limit must be an integer between 1 and 100');
+                }
+            }
+            const { client, orgId } = resolveCredentials();
+            printJson(await client.wechatHistory(orgId, opts.conversation, {
+                ...(opts.before ? { before: opts.before } : {}),
+                ...(opts.since ? { since: opts.since } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+            }));
+        }
+        catch (err) {
+            printError(err);
+        }
+    });
     wechat
         .command('contacts')
         .description('List the account address book with display names: friends, saved groups, followed official accounts')

package/dist/index.js

@@ -9,6 +9,8 @@ import { registerMessageCommands } from './commands/messages.js';
 import { registerTaskCommands } from './commands/tasks.js';
 import { registerCommentCommands } from './commands/comments.js';
 import { registerProjectCommands } from './commands/projects.js';
+import { registerProfileCommands } from './commands/profile.js';
+import { registerTeamCommands } from './commands/teams.js';
 import { registerScheduleCommands } from './commands/schedules.js';
 import { registerExternalTriggerCommands } from './commands/external-triggers.js';
 import { registerUserCommands } from './commands/users.js';
@@ -22,6 +24,7 @@ import { registerMachineCommands } from './commands/machines.js';
 import { registerClipCommands } from './commands/clip.js';
 import { registerSlackCommands } from './commands/slack.js';
 import { registerWechatCommands } from './commands/wechat.js';
+import { createUpdateNotifier } from './lib/update-check.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 const program = new Command();
@@ -37,6 +40,8 @@ registerMessageCommands(program);
 registerTaskCommands(program);
 registerCommentCommands(program);
 registerProjectCommands(program);
+registerProfileCommands(program);
+registerTeamCommands(program);
 registerScheduleCommands(program);
 registerExternalTriggerCommands(program);
 registerUserCommands(program);
@@ -50,4 +55,10 @@ registerMachineCommands(program);
 registerClipCommands(program);
 registerSlackCommands(program);
 registerWechatCommands(program);
+const updateNotifier = createUpdateNotifier(pkg.version);
+program.hook('postAction', () => {
+    if (process.exitCode === undefined || process.exitCode === 0) {
+        updateNotifier.afterSuccessfulCommand();
+    }
+});
 program.parse();

package/dist/lib/client.d.ts

@@ -28,6 +28,13 @@ export type RuntimeContext = {
     dispatchSourceId?: string;
     /** Trigger thread root (parel invocation context) — the by-source send's default thread. */
     threadRootId?: string;
+    /**
+     * Conversation generation of this execution (parel v2 invocation context,
+     * PRLL_GENERATION). Rides every dispatch_source send; the server rejects a
+     * mutation whose generation predates a New Session barrier. Absent on v1
+     * and lane-bound turns.
+     */
+    generation?: number;
 };
 /**
  * Read per-dispatch context from ENV + sideband files.
@@ -49,25 +56,36 @@ export declare function resolveRuntimeContext(): RuntimeContext;
 export declare function resolveSourceDispatchBinding(ctx: RuntimeContext, chatId: string, threadRootId: string | undefined): {
     source_type: string;
     source_id: string;
+    generation?: number;
 } | null;
 /** Typed dispatch binding for a task write, derived from the turn context. */
 export type TypedDispatchBinding = {
-    lane: string;
+    /** Claimed typed lane (v1 consumers). Absent on the converged transport,
+     *  where no lane exists and the write binds by dispatch_event_id under the
+     *  generation fence instead. */
+    lane?: string;
     dispatchEventId: string;
+    /** Conversation generation (converged transport, PRLL_GENERATION). */
+    generation?: number;
     /** Set for the first (resolving) update of this dispatch. */
     effectKey?: string;
     markCommitted: () => void;
 };
 /**
- * Resolve the typed-lane binding for `parall task update <taskId>`: the
- * current turn must be a typed dispatch (lane target `dsp:<id>`) about this
- * exact task. The first update carries the canonical
+ * Resolve the typed dispatch binding for `parall task update <taskId>`: the
+ * current turn must be a typed dispatch about this exact task.
+ *
+ * Lane-bound (v1): the first update carries the canonical
  * `task_update:<dispatch_event_id>` effect key (resolves the WorkItem in the
- * same transaction); later updates go keyless (lane-checked only). The
- * committed flag lives in a CLI-owned sidecar keyed by the typed lane; when
+ * same transaction); later updates go keyless (lane-checked only), with the
+ * committed flag in a CLI-owned sidecar keyed by the typed lane. When
  * PRLL_CONTEXT_DIR is absent the sidecar can't exist, so no effect key is
  * ever attached (a blind key would make a *different* second update replay
  * the first one's result instead of applying).
+ *
+ * Converged (no lane): the caller appends a payload hash to the base key —
+ * content addressing gives every distinct update its own idempotent key, so
+ * no sidecar state is needed at all.
  */
 export declare function resolveTypedDispatchBinding(taskId: string): TypedDispatchBinding | null;
 /** Per-lane dispatch context (PRLL_CONTEXT_DIR contract), keyed by send target. */

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAyDtD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKnD;AAED,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAwCvF;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACpB,mBAAmB,GAAG,IAAI,CA+E5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAYzE;AAED,wBAAgB,kBAAkB,IAAI,mBAAmB,CA8BxD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAkEtD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAWxE;AAED,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG;IACjC;;oCAEgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CA8DvF;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACpB,mBAAmB,GAAG,IAAI,CA+E5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAYzE;AAED,wBAAgB,kBAAkB,IAAI,mBAAmB,CA8BxD"}

package/dist/lib/client.js

@@ -18,10 +18,15 @@ export function resolveRuntimeContext() {
     const dispatchSourceType = process.env.PRLL_DISPATCH_SOURCE_TYPE?.trim() || undefined;
     const dispatchSourceId = process.env.PRLL_DISPATCH_SOURCE_ID?.trim() || undefined;
     const threadRootId = process.env.PRLL_THREAD_ROOT_ID?.trim() || undefined;
-    let dispatchEventId;
-    let lane;
-    let laneTargetUri;
-    let taskId;
+    const generationRaw = process.env.PRLL_GENERATION?.trim();
+    const generation = generationRaw && /^\d+$/.test(generationRaw) ? Number(generationRaw) : undefined;
+    // Parel v2 surfaces the lane context as plain env (there is no context
+    // file inside a parel sandbox); the CC/Codex context file below still wins
+    // per-field when both exist.
+    let dispatchEventId = process.env.PRLL_DISPATCH_EVENT_ID?.trim() || undefined;
+    let lane = process.env.PRLL_DISPATCH_LANE?.trim() || undefined;
+    let laneTargetUri = process.env.PRLL_LANE_TARGET_URI?.trim() || undefined;
+    let taskId = process.env.PRLL_TASK_ID?.trim() || undefined;
     if (process.env.PRLL_CONTEXT_FILE) {
         try {
             const raw = fs.readFileSync(process.env.PRLL_CONTEXT_FILE, 'utf-8').trim();
@@ -33,10 +38,12 @@ export function resolveRuntimeContext() {
                 stepId ??= ctx.step_id || undefined;
                 if (ctx.no_reply === true)
                     noReply = true;
-                dispatchEventId = ctx.dispatch_event_id || undefined;
-                lane = ctx.lane || undefined;
-                laneTargetUri = ctx.target_uri || undefined;
-                taskId = ctx.task_id || undefined;
+                // The file wins per-field over the parel env fallbacks above, but an
+                // absent field must not erase them.
+                dispatchEventId = ctx.dispatch_event_id || dispatchEventId;
+                lane = ctx.lane || lane;
+                laneTargetUri = ctx.target_uri || laneTargetUri;
+                taskId = ctx.task_id || taskId;
             }
         }
         catch {
@@ -66,6 +73,7 @@ export function resolveRuntimeContext() {
         dispatchSourceType,
         dispatchSourceId,
         threadRootId,
+        generation,
     };
 }
 /**
@@ -83,36 +91,67 @@ export function resolveSourceDispatchBinding(ctx, chatId, threadRootId) {
         return null;
     if ((threadRootId ?? '') !== (ctx.threadRootId ?? ''))
         return null;
-    return { source_type: ctx.dispatchSourceType, source_id: ctx.dispatchSourceId };
+    return {
+        source_type: ctx.dispatchSourceType,
+        source_id: ctx.dispatchSourceId,
+        // v2 executions carry their conversation generation; the server fences
+        // stale-generation replies inside the commit transaction.
+        ...(ctx.generation !== undefined ? { generation: ctx.generation } : {}),
+    };
 }
 /**
- * Resolve the typed-lane binding for `parall task update <taskId>`: the
- * current turn must be a typed dispatch (lane target `dsp:<id>`) about this
- * exact task. The first update carries the canonical
+ * Resolve the typed dispatch binding for `parall task update <taskId>`: the
+ * current turn must be a typed dispatch about this exact task.
+ *
+ * Lane-bound (v1): the first update carries the canonical
  * `task_update:<dispatch_event_id>` effect key (resolves the WorkItem in the
- * same transaction); later updates go keyless (lane-checked only). The
- * committed flag lives in a CLI-owned sidecar keyed by the typed lane; when
+ * same transaction); later updates go keyless (lane-checked only), with the
+ * committed flag in a CLI-owned sidecar keyed by the typed lane. When
  * PRLL_CONTEXT_DIR is absent the sidecar can't exist, so no effect key is
  * ever attached (a blind key would make a *different* second update replay
  * the first one's result instead of applying).
+ *
+ * Converged (no lane): the caller appends a payload hash to the base key —
+ * content addressing gives every distinct update its own idempotent key, so
+ * no sidecar state is needed at all.
  */
 export function resolveTypedDispatchBinding(taskId) {
     const ctx = resolveRuntimeContext();
-    if (!ctx.lane || !ctx.dispatchEventId)
-        return null;
-    if (!ctx.laneTargetUri?.startsWith('dsp:'))
+    if (!ctx.dispatchEventId)
         return null;
     if (!ctx.taskId || ctx.taskId !== taskId)
         return null;
-    const binding = {
-        lane: ctx.lane,
-        dispatchEventId: ctx.dispatchEventId,
-        markCommitted: () => { },
-    };
+    let binding;
+    let sidecarKey;
+    if (!ctx.lane) {
+        // Converged transport: no lane exists — the write binds by
+        // dispatch_event_id under the server's generation fence. A context with
+        // no generation must NOT produce a binding: an unfenced by-id write
+        // would bypass the New Session barrier (the server rejects it anyway —
+        // failing closed here keeps the task update itself working as a plain
+        // write). Content-addressed keys replace the reply-slot sidecar on this
+        // path: the caller appends a payload hash to the base key, so a
+        // same-payload retry replays its own key idempotently while a different
+        // second update mints a new key and lands as its own Effect.
+        if (ctx.generation === undefined)
+            return null;
+        return {
+            dispatchEventId: ctx.dispatchEventId,
+            generation: ctx.generation,
+            effectKey: `task_update:${ctx.dispatchEventId}`,
+            markCommitted: () => { },
+        };
+    }
+    // Lane-bound (v1 consumers): the write rides the claimed typed lane and
+    // the reply-slot sidecar arbitrates the single resolving key.
+    if (!ctx.laneTargetUri?.startsWith('dsp:'))
+        return null;
+    binding = { lane: ctx.lane, dispatchEventId: ctx.dispatchEventId, markCommitted: () => { } };
+    sidecarKey = ctx.laneTargetUri;
     const contextDir = process.env.PRLL_CONTEXT_DIR?.trim();
     if (!contextDir)
         return binding;
-    const sidecarPath = laneReplyStateFilePath(contextDir, ctx.laneTargetUri);
+    const sidecarPath = laneReplyStateFilePath(contextDir, sidecarKey);
     let committed = false;
     try {
         const sidecar = JSON.parse(fs.readFileSync(sidecarPath, 'utf-8'));
@@ -122,19 +161,22 @@ export function resolveTypedDispatchBinding(taskId) {
     catch {
         // No sidecar yet — resolving update not committed.
     }
-    if (!committed) {
-        const dispatchEventId = ctx.dispatchEventId;
-        binding.effectKey = `task_update:${dispatchEventId}`;
-        binding.markCommitted = () => {
-            try {
-                fs.writeFileSync(sidecarPath, JSON.stringify({ dispatch_event_id: dispatchEventId, reply_committed: true }), 'utf-8');
-            }
-            catch {
-                // Best-effort — a lost sidecar means the next update retries the key
-                // and the server's effect ledger replies idempotently.
-            }
-        };
+    if (committed) {
+        // Resolving update already landed: later updates go keyless.
+        delete binding.effectKey;
+        return binding;
     }
+    const dispatchEventId = ctx.dispatchEventId;
+    binding.effectKey = `task_update:${dispatchEventId}`;
+    binding.markCommitted = () => {
+        try {
+            fs.writeFileSync(sidecarPath, JSON.stringify({ dispatch_event_id: dispatchEventId, reply_committed: true }), 'utf-8');
+        }
+        catch {
+            // Best-effort — a lost sidecar means the next update retries the key
+            // and the server's effect ledger replies idempotently.
+        }
+    };
     return binding;
 }
 /**

package/dist/lib/output.d.ts

@@ -21,5 +21,5 @@ export declare function ensurePrllScheme(idOrUri: string): string;
  * than receiving a malformed value.
  */
 export declare function parsePositiveInt(raw: string | undefined): number | undefined;
-export declare function printError(err: unknown): never;
+export declare function printError(err: unknown, attemptedPayload?: Record<string, unknown>): never;
 //# sourceMappingURL=output.d.ts.map

package/dist/lib/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,IAAI,CAEvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW5E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAwC9C"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAY,GAAG,IAAI,CAEvE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW5E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CA8C1F"}

package/dist/lib/output.js

@@ -43,7 +43,7 @@ export function parsePositiveInt(raw) {
     const n = Number(t);
     return Number.isInteger(n) && n > 0 ? n : undefined;
 }
-export function printError(err) {
+export function printError(err, attemptedPayload) {
     if (err instanceof ApiError) {
         // Faithful, parseable line: the server's real message + machine anchors.
         console.error(JSON.stringify({
@@ -70,7 +70,13 @@ export function printError(err) {
                     ? 'This action can be approved.'
                     : 'This action may be approvable.';
                 const chat = err.resourceUri?.startsWith('prll://cht_') ? err.resourceUri : '<chat_id>';
-                console.error(`${lead} Request approval:\n  parall approvals request --action ${err.action} --resource ${err.resourceUri ?? '<resource>'} --chat ${chat} --title "..." --reason "..."`);
+                // When the failing command knows exactly what it tried to write, the
+                // proposal command is prefilled with that payload — the deny → propose
+                // loop then needs no re-assembly by the caller.
+                const payloadArg = attemptedPayload
+                    ? ` --payload '${JSON.stringify(attemptedPayload).replaceAll("'", `'\\''`)}'`
+                    : '';
+                console.error(`${lead} Request approval:\n  parall approvals request --action ${err.action} --resource ${err.resourceUri ?? '<resource>'}${payloadArg} --chat ${chat} --title "..." --reason "..."`);
             }
         }
     }

package/dist/lib/update-check.d.ts

@@ -0,0 +1,29 @@
+import { spawn } from 'node:child_process';
+export declare const UPDATE_CHECK_TIMEOUT_MS = 1500;
+type UpdateNotifierOptions = {
+    now?: () => number;
+    cachePath?: string;
+    spawnWorker?: (cachePath: string) => void;
+    writeHint?: (hint: string) => void;
+    disabled?: boolean;
+};
+type RefreshOptions = {
+    now?: () => number;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    registryUrl?: string;
+};
+export type UpdateNotifier = {
+    afterSuccessfulCommand: () => void;
+};
+export declare function isNewerRelease(currentVersion: string, latestVersion: string): boolean;
+/**
+ * Acquire the cache's cross-process lock. The token check prevents a stale
+ * owner from deleting a replacement lock when it eventually resumes.
+ */
+export declare function acquireUpdateStateLock(cachePath: string, now?: () => number): (() => void) | null;
+export declare function spawnUpdateCheckWorker(cachePath: string, spawnImpl?: typeof spawn): void;
+export declare function createUpdateNotifier(currentVersion: string, options?: UpdateNotifierOptions): UpdateNotifier;
+export declare function refreshUpdateCache(cachePath: string, options?: RefreshOptions): Promise<void>;
+export {};
+//# sourceMappingURL=update-check.d.ts.map

package/dist/lib/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/lib/update-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAW3C,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAS7C,KAAK,qBAAqB,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,sBAAsB,EAAE,MAAM,IAAI,CAAC;CACpC,CAAC;AAQF,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAUrF;AA4CD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB,GAC3B,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAkErB;AAgBD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,IAAI,CAW/F;AAWD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAyDhB;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA+Bf"}

package/dist/lib/update-check.js

@@ -0,0 +1,269 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const REGISTRY_URL = 'https://registry.npmjs.org/@parall%2Fcli/latest';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const RETRY_INTERVAL_MS = 60 * 60 * 1000;
+const LOCK_STALE_MS = 30_000;
+export const UPDATE_CHECK_TIMEOUT_MS = 1_500;
+function releaseParts(version) {
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+    if (!match)
+        return null;
+    return [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])];
+}
+export function isNewerRelease(currentVersion, latestVersion) {
+    const current = releaseParts(currentVersion);
+    const latest = releaseParts(latestVersion);
+    if (!current || !latest)
+        return false;
+    for (let i = 0; i < current.length; i++) {
+        if (latest[i] > current[i])
+            return true;
+        if (latest[i] < current[i])
+            return false;
+    }
+    return false;
+}
+function defaultCachePath() {
+    const envRoot = process.env.XDG_CACHE_HOME?.trim();
+    const cacheRoot = envRoot ||
+        (process.platform === 'win32' && process.env.LOCALAPPDATA?.trim()) ||
+        path.join(os.homedir(), '.cache');
+    return path.join(cacheRoot, 'parall', 'update-check.json');
+}
+function readState(cachePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+        const state = {};
+        if (typeof parsed.latest_version === 'string')
+            state.latest_version = parsed.latest_version;
+        if (typeof parsed.last_success_at === 'number')
+            state.last_success_at = parsed.last_success_at;
+        if (typeof parsed.last_attempt_at === 'number')
+            state.last_attempt_at = parsed.last_attempt_at;
+        if (typeof parsed.last_notified_at === 'number') {
+            state.last_notified_at = parsed.last_notified_at;
+        }
+        return state;
+    }
+    catch {
+        return {};
+    }
+}
+function writeState(cachePath, state) {
+    const tempPath = `${cachePath}.${process.pid}.tmp`;
+    try {
+        fs.mkdirSync(path.dirname(cachePath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(tempPath, `${JSON.stringify(state)}\n`, { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(tempPath, cachePath);
+        return true;
+    }
+    catch {
+        try {
+            fs.unlinkSync(tempPath);
+        }
+        catch {
+            // Best-effort cleanup only.
+        }
+        return false;
+    }
+}
+/**
+ * Acquire the cache's cross-process lock. The token check prevents a stale
+ * owner from deleting a replacement lock when it eventually resumes.
+ */
+export function acquireUpdateStateLock(cachePath, now = Date.now) {
+    const lockPath = `${cachePath}.lock`;
+    const withTokenGate = (token, action) => {
+        const tokenHash = createHash('sha256').update(token).digest('hex');
+        const gatePath = `${lockPath}.reclaim-${tokenHash}`;
+        const gateToken = `${process.pid}:${randomUUID()}`;
+        try {
+            fs.writeFileSync(gatePath, gateToken, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        }
+        catch {
+            return undefined;
+        }
+        try {
+            return action();
+        }
+        finally {
+            try {
+                if (fs.readFileSync(gatePath, 'utf8') === gateToken)
+                    fs.unlinkSync(gatePath);
+            }
+            catch {
+                // A lost/replaced gate is already released from this owner's perspective.
+            }
+        }
+    };
+    const tryAcquire = () => {
+        const token = `${process.pid}:${randomUUID()}`;
+        try {
+            fs.mkdirSync(path.dirname(cachePath), { recursive: true, mode: 0o700 });
+            fs.writeFileSync(lockPath, token, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        }
+        catch {
+            return null;
+        }
+        return () => {
+            withTokenGate(token, () => {
+                try {
+                    if (fs.readFileSync(lockPath, 'utf8') === token)
+                        fs.unlinkSync(lockPath);
+                }
+                catch {
+                    // A lost/replaced lock is already released from this owner's perspective.
+                }
+            });
+        };
+    };
+    const release = tryAcquire();
+    if (release)
+        return release;
+    let staleToken;
+    try {
+        staleToken = fs.readFileSync(lockPath, 'utf8');
+        if (now() - fs.statSync(lockPath).mtimeMs < LOCK_STALE_MS)
+            return null;
+    }
+    catch (err) {
+        return err.code === 'ENOENT' ? tryAcquire() : null;
+    }
+    return (withTokenGate(staleToken, () => {
+        try {
+            if (fs.readFileSync(lockPath, 'utf8') !== staleToken)
+                return null;
+            if (now() - fs.statSync(lockPath).mtimeMs < LOCK_STALE_MS)
+                return null;
+            fs.unlinkSync(lockPath);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return null;
+        }
+        return tryAcquire();
+    }) ?? null);
+}
+function withUpdateStateLock(cachePath, now, update) {
+    const release = acquireUpdateStateLock(cachePath, now);
+    if (!release)
+        return undefined;
+    try {
+        return update();
+    }
+    finally {
+        release();
+    }
+}
+export function spawnUpdateCheckWorker(cachePath, spawnImpl = spawn) {
+    const workerPath = fileURLToPath(new URL('../update-check-worker.js', import.meta.url));
+    const child = spawnImpl(process.execPath, [workerPath, cachePath], {
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+    });
+    child.on('error', () => {
+        // A missing/broken Node binary must not turn a completed CLI command into a failure.
+    });
+    child.unref();
+}
+function updateChecksDisabled() {
+    const ci = process.env.CI?.trim().toLowerCase();
+    return (process.env.PRLL_DISABLE_UPDATE_CHECK === '1' ||
+        process.env.NO_UPDATE_NOTIFIER === '1' ||
+        Boolean(ci && ci !== '0' && ci !== 'false'));
+}
+export function createUpdateNotifier(currentVersion, options = {}) {
+    const now = options.now ?? Date.now;
+    const cachePath = options.cachePath ?? defaultCachePath();
+    const spawnWorker = options.spawnWorker ?? spawnUpdateCheckWorker;
+    const writeHint = options.writeHint ?? ((hint) => process.stderr.write(hint));
+    const disabled = options.disabled ?? updateChecksDisabled();
+    return {
+        afterSuccessfulCommand: () => {
+            if (disabled || !releaseParts(currentVersion))
+                return;
+            const timestamp = now();
+            const decision = withUpdateStateLock(cachePath, now, () => {
+                const state = readState(cachePath);
+                let hint;
+                let changed = false;
+                if (state.latest_version &&
+                    isNewerRelease(currentVersion, state.latest_version) &&
+                    timestamp - (state.last_notified_at ?? 0) >= CHECK_INTERVAL_MS) {
+                    hint =
+                        `Update available: parall ${currentVersion} → ${state.latest_version}. ` +
+                            'Upgrade @parall/cli@latest with your package manager.\n';
+                    state.last_notified_at = timestamp;
+                    changed = true;
+                }
+                const successfulCheckIsFresh = timestamp - (state.last_success_at ?? 0) < CHECK_INTERVAL_MS;
+                const recentAttempt = timestamp - (state.last_attempt_at ?? 0) < RETRY_INTERVAL_MS;
+                const shouldSpawnWorker = !successfulCheckIsFresh && !recentAttempt;
+                if (shouldSpawnWorker) {
+                    state.last_attempt_at = timestamp;
+                    changed = true;
+                }
+                if (changed && !writeState(cachePath, state))
+                    return undefined;
+                return { hint, shouldSpawnWorker };
+            });
+            if (!decision)
+                return;
+            if (decision.hint) {
+                try {
+                    writeHint(decision.hint);
+                }
+                catch {
+                    // A closed output stream must not change the command's exit status.
+                }
+            }
+            if (!decision.shouldSpawnWorker)
+                return;
+            try {
+                spawnWorker(cachePath);
+            }
+            catch {
+                // Update checks never affect the command that triggered them.
+            }
+        },
+    };
+}
+export async function refreshUpdateCache(cachePath, options = {}) {
+    const fetchImpl = options.fetch ?? fetch;
+    const timeoutMs = options.timeoutMs ?? UPDATE_CHECK_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(options.registryUrl ?? REGISTRY_URL, {
+            headers: { accept: 'application/json' },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return;
+        const body = (await response.json());
+        if (typeof body.version !== 'string' || !releaseParts(body.version))
+            return;
+        const latestVersion = body.version;
+        const now = options.now ?? Date.now;
+        withUpdateStateLock(cachePath, now, () => {
+            const state = readState(cachePath);
+            writeState(cachePath, {
+                ...state,
+                latest_version: latestVersion,
+                last_success_at: now(),
+            });
+        });
+    }
+    catch {
+        // Network, timeout, registry, and cache failures are intentionally silent.
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/update-check-worker.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=update-check-worker.d.ts.map

package/dist/update-check-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check-worker.d.ts","sourceRoot":"","sources":["../src/update-check-worker.ts"],"names":[],"mappings":""}

package/dist/update-check-worker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { refreshUpdateCache } from './lib/update-check.js';
+const cachePath = process.argv[2];
+if (cachePath)
+    await refreshUpdateCache(cachePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/cli",
-  "version": "1.55.3",
+  "version": "1.55.4",
   "description": "CLI client for Parall — universal agent & human access to Parall API",
   "license": "MIT",
   "repository": {
@@ -36,14 +36,14 @@
     "diff": "^8.0.3",
     "js-yaml": "^4.1.0",
     "zod": "^4.3.6",
-    "@parall/agent-core": "1.55.3",
-    "@parall/sdk": "1.55.3"
+    "@parall/agent-core": "1.55.4",
+    "@parall/sdk": "1.55.4"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
-    "@parall/agent-core": "1.55.3"
+    "@parall/agent-core": "1.55.4"
   },
   "scripts": {
     "build": "tsc",