@parall/daemon 1.28.0 → 1.29.0

package/dist/runtimes.js

@@ -1,7 +1,28 @@
+import * as path from "node:path";
+function llmSource(pc) {
+    if (pc?.llm_source)
+        return pc.llm_source;
+    if (pc?.openai_api_key ||
+        pc?.openai_base_url ||
+        pc?.anthropic_auth_token ||
+        pc?.anthropic_base_url) {
+        return "custom";
+    }
+    return "parall";
+}
+function clearAllProviderCreds(env) {
+    delete env.ANTHROPIC_AUTH_TOKEN;
+    delete env.ANTHROPIC_BASE_URL;
+    delete env.ANTHROPIC_API_KEY;
+    delete env.OPENAI_API_KEY;
+    delete env.OPENAI_BASE_URL;
+    delete env.PRLL_CLAUDE_ALLOW_API_KEY;
+}
 const claudeCodeAdapter = {
     bin: "parall-claude-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
         const env = { ...baseEnv };
+        clearAllProviderCreds(env);
         env.PRLL_API_KEY = apiKey;
         env.PRLL_ORG_ID = orgId;
         env.AGENT_ID = agentId;
@@ -9,8 +30,19 @@ const claudeCodeAdapter = {
         env.PRLL_CLAUDE_HOME = dirs.claudeHome;
         env.PRLL_CLAUDE_STATE_DIR = dirs.stateDir;
         env.PRLL_CLAUDE_WORKSPACE_DIR = dirs.workspaceDir;
-        if ("ANTHROPIC_AUTH_TOKEN" in env) {
+        const source = llmSource(pc);
+        if (source === "parall") {
             env.ANTHROPIC_AUTH_TOKEN = apiKey;
+            env.ANTHROPIC_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm`;
+            env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
+        }
+        else if (source === "custom") {
+            if (pc?.anthropic_auth_token) {
+                env.ANTHROPIC_AUTH_TOKEN = pc.anthropic_auth_token;
+                env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
+            }
+            if (pc?.anthropic_base_url)
+                env.ANTHROPIC_BASE_URL = pc.anthropic_base_url;
         }
         delete env.PRLL_DAEMON_MODE;
         return env;
@@ -18,14 +50,27 @@ const claudeCodeAdapter = {
 };
 const codexAdapter = {
     bin: "parall-codex-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
         const env = { ...baseEnv };
+        clearAllProviderCreds(env);
         env.PRLL_API_KEY = apiKey;
         env.PRLL_ORG_ID = orgId;
         env.AGENT_ID = agentId;
         env.PRLL_AGENT_ID = agentId;
         env.PRLL_CODEX_STATE_DIR = dirs.stateDir;
         env.PRLL_CODEX_WORKSPACE_DIR = dirs.workspaceDir;
+        env.PRLL_CODEX_HOME = path.join(dirs.stateDir, ".codex");
+        const source = llmSource(pc);
+        if (source === "parall") {
+            env.OPENAI_API_KEY = apiKey;
+            env.OPENAI_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm/v1`;
+        }
+        else if (source === "custom") {
+            if (pc?.openai_api_key)
+                env.OPENAI_API_KEY = pc.openai_api_key;
+            if (pc?.openai_base_url)
+                env.OPENAI_BASE_URL = pc.openai_base_url;
+        }
         delete env.PRLL_DAEMON_MODE;
         return env;
     },
@@ -48,6 +93,7 @@ const openclawAdapter = {
     bin: "parall-openclaw-agent",
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
         const env = { ...baseEnv };
+        clearAllProviderCreds(env);
         env.PRLL_API_KEY = apiKey;
         env.PRLL_ORG_ID = orgId;
         env.AGENT_ID = agentId;

package/dist/supervisor.d.ts

@@ -1,10 +1,6 @@
+import type { GatewayLogger } from "@parall/agent-core";
 import { ParallClient } from "@parall/sdk";
 import { type ClaudeDaemonConfig } from "./config.js";
-export interface DaemonLogger {
-    info(msg: string): void;
-    warn(msg: string): void;
-    error(msg: string): void;
-}
 /**
  * Sleep that wakes early on abort. Returns true if the full delay elapsed,
  * false if aborted. Used by bootstrap retry and the outer keepalive in
@@ -31,16 +27,25 @@ export declare class DaemonSupervisor {
     private ws;
     private running;
     private machineOrgId;
+    private machineLlmSource;
     private stopResolve;
-    constructor(config: ClaudeDaemonConfig, client: ParallClient, log: DaemonLogger);
+    constructor(config: ClaudeDaemonConfig, client: ParallClient, log: GatewayLogger);
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     run(signal: AbortSignal): Promise<void>;
     /** Disconnect WS, cancel timers, SIGTERM all children, await exit. */
     stop(): Promise<void>;
     private bootstrapWithRetry;
     private fullReconcile;
+    /**
+     * Detects a legacy flat state layout (no agents/ subdir) and migrates it
+     * into the per-agent directory for the owning agent. Ownership is determined
+     * by parsing session state files which embed the agent ID in the runtimeKey.
+     */
+    private migrateFlatLayout;
     private handleAgentAttached;
     private handleAgentDetached;
+    private refreshMachineConfig;
+    private respawnAllChildren;
     private restartChildNow;
     private spawnAgent;
     private startChild;

package/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAmJ,MAAM,aAAa,CAAC;AAC5L,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAmB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,WAAW,CAA6B;gBAG7B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,YAAY;IAGpC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA6Bb,kBAAkB;YAoClB,aAAa;YAqDb,mBAAmB;YA6BnB,mBAAmB;YAgBnB,eAAe;YAcf,UAAU;IAmCxB,OAAO,CAAC,UAAU;YAgEJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAkL,MAAM,aAAa,CAAC;AAC3N,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AASrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IASzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;gBAG7B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA4E7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA6Bb,kBAAkB;YAqClB,aAAa;IAqD3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,mBAAmB;YA6BnB,mBAAmB;YAgBnB,oBAAoB;YAcpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;IAgDxB,OAAO,CAAC,UAAU;YAyEJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}

package/dist/supervisor.js

@@ -4,6 +4,11 @@ import * as path from "node:path";
 import { ParallWs } from "@parall/sdk";
 import { agentClaudeCredentialsFileFor, agentClaudeHomeFor, agentStateDirFor, agentWorkspaceDirFor, sharedClaudeCredentialsFileFor, } from "./config.js";
 import { assertAgentKey, getRuntimeAdapter } from "./runtimes.js";
+const RUNTIME_PACKAGES = {
+    'claude-code': '@parall/claude-agent',
+    'codex': '@parall/codex-agent',
+    'openclaw': '@parall/openclaw-agent',
+};
 /**
  * Sleep that wakes early on abort. Returns true if the full delay elapsed,
  * false if aborted. Used by bootstrap retry and the outer keepalive in
@@ -44,6 +49,7 @@ export class DaemonSupervisor {
     ws = null;
     running = false;
     machineOrgId = null;
+    machineLlmSource = "parall";
     stopResolve = null;
     constructor(config, client, log) {
         this.config = config;
@@ -71,6 +77,7 @@ export class DaemonSupervisor {
             this.running = false;
             throw err;
         }
+        this.migrateFlatLayout();
         await this.fullReconcile();
         this.ws = new ParallWs({
             getTicket: () => this.client.getMachineWsTicket(),
@@ -79,7 +86,10 @@ export class DaemonSupervisor {
         });
         this.ws.on("machine.hello", (_data) => {
             this.log.info("machine WS connected (machine.hello)");
-            void this.fullReconcile();
+            void (async () => {
+                await this.refreshMachineConfig();
+                await this.fullReconcile();
+            })();
         });
         this.ws.on("machine.agent.attached", (data) => {
             this.log.info(`WS: agent ${data.agent_id} attached`);
@@ -89,6 +99,14 @@ export class DaemonSupervisor {
             this.log.info(`WS: agent ${data.agent_id} detached`);
             void this.handleAgentDetached(data.agent_id);
         });
+        this.ws.on("machine.config.updated", (data) => {
+            const newSource = data.llm_source ?? "parall";
+            if (newSource !== this.machineLlmSource) {
+                this.log.info(`WS: llm_source changed ${this.machineLlmSource} → ${newSource}, respawning all agents`);
+                this.machineLlmSource = newSource;
+                void this.respawnAllChildren();
+            }
+        });
         this.ws.on("machine.stop", (data) => {
             this.log.info(`WS: machine.stop received (reason=${data.reason ?? "none"})`);
             void this.stop();
@@ -137,6 +155,7 @@ export class DaemonSupervisor {
             try {
                 const machine = await this.client.getMachineSelf();
                 this.machineOrgId = machine.org_id;
+                this.machineLlmSource = machine.llm_source ?? "parall";
                 this.log.info(`daemon online — machine_id=${machine.id} org=${machine.org_id} label=${machine.label}`);
                 return true;
             }
@@ -209,6 +228,54 @@ export class DaemonSupervisor {
             }
         }
     }
+    // ---- Flat layout migration (self-hosted → daemon) ----
+    /**
+     * Detects a legacy flat state layout (no agents/ subdir) and migrates it
+     * into the per-agent directory for the owning agent. Ownership is determined
+     * by parsing session state files which embed the agent ID in the runtimeKey.
+     */
+    migrateFlatLayout() {
+        const root = this.config.rootStateDir;
+        const agentsDir = path.join(root, "agents");
+        const flatWorkspace = path.join(root, "workspace");
+        if (!fs.existsSync(flatWorkspace) || fs.existsSync(agentsDir))
+            return;
+        let ownerAgentId;
+        const sessionsDir = path.join(root, "sessions");
+        if (fs.existsSync(sessionsDir)) {
+            try {
+                for (const file of fs.readdirSync(sessionsDir)) {
+                    if (!file.endsWith(".json"))
+                        continue;
+                    const decoded = Buffer.from(file.replace(".json", ""), "base64url").toString();
+                    // runtimeKey format: "agent:main:{runtime}:{agentId}:orchestrator"
+                    const parts = decoded.split(":");
+                    if (parts.length >= 4 && parts[3].startsWith("usr_")) {
+                        ownerAgentId = parts[3];
+                        break;
+                    }
+                }
+            }
+            catch {
+                // best-effort scan
+            }
+        }
+        const targetId = ownerAgentId ?? "_orphan";
+        const targetDir = path.join(agentsDir, targetId);
+        try {
+            fs.mkdirSync(targetDir, { recursive: true });
+            for (const sub of ["workspace", "sessions", "dispatch-context"]) {
+                const src = path.join(root, sub);
+                if (fs.existsSync(src)) {
+                    fs.renameSync(src, path.join(targetDir, sub));
+                }
+            }
+            this.log.info(`migrated legacy flat state → agents/${targetId}/`);
+        }
+        catch (err) {
+            this.log.warn(`flat layout migration failed: ${String(err)}`);
+        }
+    }
     // ---- WS event handlers (incremental) ----
     async handleAgentAttached(agentId) {
         if (this.children.has(agentId))
@@ -251,6 +318,31 @@ export class DaemonSupervisor {
         this.children.delete(agentId);
     }
     // ---- Spawn / restart ----
+    async refreshMachineConfig() {
+        try {
+            const machine = await this.client.getMachineSelf();
+            const newSource = machine.llm_source ?? "parall";
+            if (newSource !== this.machineLlmSource) {
+                this.log.info(`machine config refreshed: llm_source ${this.machineLlmSource} → ${newSource}`);
+                this.machineLlmSource = newSource;
+                await this.respawnAllChildren();
+            }
+        }
+        catch (err) {
+            this.log.warn(`refreshMachineConfig failed: ${String(err)}`);
+        }
+    }
+    async respawnAllChildren() {
+        const states = [...this.children.values()];
+        for (const state of states) {
+            await this.terminateChild(state);
+        }
+        for (const state of states) {
+            if (!state.shuttingDown && this.running) {
+                await this.restartChildNow(state, "llm_source changed");
+            }
+        }
+    }
     async restartChildNow(state, reason) {
         if (!this.running || state.shuttingDown || state.child || state.restartTimer) {
             return;
@@ -275,13 +367,23 @@ export class DaemonSupervisor {
             return;
         }
         const stateDir = agentStateDirFor(this.config.rootStateDir, agentId);
-        const workspaceDir = agentWorkspaceDirFor(this.config.rootStateDir, agentId);
-        const claudeHome = agentClaudeHomeFor(this.config.rootClaudeHome, agentId);
+        const workspaceDir = attached.daemon_config?.workspace_path
+            || agentWorkspaceDirFor(this.config.rootStateDir, agentId);
+        const isK8s = !!process.env.KUBERNETES_SERVICE_HOST;
+        const claudeHome = isK8s
+            ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId)
+            : this.config.rootClaudeHome;
         try {
             fs.mkdirSync(stateDir, { recursive: true });
-            fs.mkdirSync(workspaceDir, { recursive: true });
-            fs.mkdirSync(claudeHome, { recursive: true });
-            this.ensureSharedCredentialLink(claudeHome, agentId);
+            // Only create workspace dir when using the default isolated path —
+            // user-specified workspace_path should already exist.
+            if (!attached.daemon_config?.workspace_path) {
+                fs.mkdirSync(workspaceDir, { recursive: true });
+            }
+            if (isK8s) {
+                fs.mkdirSync(claudeHome, { recursive: true });
+                this.ensureSharedCredentialLink(claudeHome, agentId);
+            }
         }
         catch (err) {
             this.log.warn(`mkdir agent dirs (${agentId}) failed: ${String(err)}`);
@@ -291,6 +393,9 @@ export class DaemonSupervisor {
             agentId,
             orgId,
             runtimeType,
+            workspacePath: workspaceDir,
+            claudeHome,
+            providerConfig: attached.provider_config ?? { llm_source: this.machineLlmSource },
             child: null,
             credential,
             restartAttempts: 0,
@@ -311,10 +416,10 @@ export class DaemonSupervisor {
         const adapter = getRuntimeAdapter(state.runtimeType);
         const dirs = {
             stateDir: agentStateDirFor(this.config.rootStateDir, state.agentId),
-            workspaceDir: agentWorkspaceDirFor(this.config.rootStateDir, state.agentId),
-            claudeHome: agentClaudeHomeFor(this.config.rootClaudeHome, state.agentId),
+            workspaceDir: state.workspacePath,
+            claudeHome: state.claudeHome,
         };
-        const env = adapter.buildEnv({ ...process.env, PRLL_API_URL: this.config.apiUrl }, state.agentId, state.orgId, state.credential.api_key, dirs);
+        const env = adapter.buildEnv({ ...process.env, PRLL_API_URL: this.config.apiUrl }, state.agentId, state.orgId, state.credential.api_key, dirs, state.providerConfig);
         this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} bin=${adapter.bin} (attempt ${state.restartAttempts + 1})`);
         const child = spawn(adapter.bin, [], {
             env,
@@ -347,7 +452,13 @@ export class DaemonSupervisor {
                 this.startChild(state);
             }, delay);
         };
-        child.once("error", (err) => settleChild("error", null, null, err));
+        child.once("error", (err) => {
+            if (err.code === 'ENOENT') {
+                const pkg = RUNTIME_PACKAGES[state.runtimeType] ?? `@parall/${state.runtimeType}-agent`;
+                this.log.error(`Runtime binary "${adapter.bin}" not found in PATH. Install: npm install -g ${pkg}`);
+            }
+            settleChild("error", null, null, err);
+        });
         child.once("close", (code, signal) => settleChild("close", code, signal));
         setTimeout(() => {
             if (state.child === child) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@parall/daemon",
-  "version": "1.28.0",
-  "description": "Per-host supervisor for daemon-mode Parall Machines — fans one mck_ bearer out into N agent-runtime subprocesses, one per attached agent",
+  "version": "1.29.0",
+  "description": "Parall local agent runtime — daemon supervisor + bridge runtimes, bundled as standalone JS files",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -9,10 +9,14 @@
     "directory": "ts/daemon"
   },
   "type": "module",
-  "main": "./dist/index.js",
+  "main": "./bundle/parall-daemon.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "parall-daemon": "./dist/index.js"
+    "daemon": "./bundle/parall-daemon.js",
+    "parall-daemon": "./bundle/parall-daemon.js",
+    "parall-claude-agent": "./bundle/parall-claude-agent.js",
+    "parall-codex-agent": "./bundle/parall-codex-agent.js",
+    "parall-openclaw-agent": "./bundle/parall-openclaw-agent.js"
   },
   "exports": {
     ".": {
@@ -21,18 +25,24 @@
     }
   },
   "files": [
-    "dist",
-    "src"
+    "bundle",
+    "dist"
   ],
   "dependencies": {
-    "@parall/sdk": "1.28.0"
+    "@parall/agent-core": "1.29.0",
+    "@parall/sdk": "1.29.0",
+    "@parall/claude-agent": "1.29.0",
+    "@parall/codex-agent": "1.29.0",
+    "@parall/openclaw-agent": "1.29.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "esbuild": "^0.25.0",
     "typescript": "^5.7.0"
   },
   "scripts": {
     "build": "tsc -b",
-    "start": "node dist/index.js"
+    "bundle": "node ../../scripts/bundle-daemon.mjs",
+    "start": "node bundle/parall-daemon.js"
   }
 }

package/src/config.ts

@@ -1,146 +0,0 @@
-import * as os from "node:os";
-import * as path from "node:path";
-
-/**
- * Daemon-mode env. The daemon authenticates to the Parall API with an
- * `mck_*` bearer token (PRLL_API_KEY) and supervises N per-agent
- * `parall-claude-agent` subprocesses on this host.
- *
- * Compared to claude-agent's config:
- *   - `apiKey` is an mck_ bearer (Machine-scoped), not an agk_
- *   - there is no PRLL_ORG_ID — the Machine row's org_id is implicit;
- *     each spawned per-agent subprocess is given its own PRLL_ORG_ID
- *     resolved from the AttachedAgent's profile / org context
- *   - per-agent state lives at `<rootStateDir>/agents/<agent_id>/`
- */
-export type ClaudeDaemonConfig = {
-  apiUrl: string;
-  /** mck_*-prefixed Machine bearer. */
-  apiKey: string;
-  /** @deprecated Superseded by RuntimeAdapter pattern (runtimes.ts). Kept for backward compat / fallback. */
-  agentBin: string;
-  /** Root for per-agent state dirs. Each agent gets `<rootStateDir>/agents/<agent_id>`. */
-  rootStateDir: string;
-  /** Shared host home root. Per-agent HOME dirs live under `<rootClaudeHome>/agents/<agent_id>`. */
-  rootClaudeHome: string;
-  /** Optional WS URL override for the machine control-plane WebSocket. */
-  wsUrl?: string;
-  /** @deprecated Superseded by WS event-driven model; kept for backward compat. */
-  pollIntervalMs: number;
-  /** @deprecated Superseded by WS event-driven model; kept for backward compat. */
-  heartbeatIntervalMs: number;
-  /** Backoff base after a subprocess crash, in ms. */
-  restartBackoffMs: number;
-  /** Hard cap on parallel restart attempts per agent before giving up for a cycle. */
-  restartBackoffMaxMs: number;
-  /**
-   * Bootstrap retry: when `getMachineSelf` fails on startup (network blip,
-   * mck_ key not yet propagated, server warming up), wait this long and
-   * retry instead of crashing the daemon. Exponential backoff up to
-   * `bootstrapBackoffMaxMs`. Set 0 to disable (fail-fast on first error).
-   */
-  bootstrapBackoffMs: number;
-  bootstrapBackoffMaxMs: number;
-  /**
-   * Outer supervisor keepalive: if `supervisor.run()` rejects with an
-   * unexpected error, wait this long and reinstantiate. Same exp-backoff
-   * shape as bootstrap. Set 0 to disable (let main() exit, rely on K8s/PID-1).
-   */
-  supervisorRestartBackoffMs: number;
-  supervisorRestartBackoffMaxMs: number;
-};
-
-function requireEnv(env: NodeJS.ProcessEnv, name: string): string {
-  const value = env[name]?.trim();
-  if (!value) {
-    throw new Error(`Missing required env var: ${name}`);
-  }
-  return value;
-}
-
-function resolvePath(value: string): string {
-  return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
-}
-
-function parseMs(value: string | undefined, fallback: number): number {
-  if (!value) return fallback;
-  const n = Number(value);
-  return Number.isFinite(n) && n > 0 ? n : fallback;
-}
-
-/** Like parseMs but allows 0 (operator opt-out). */
-function parseMsAllowZero(value: string | undefined, fallback: number): number {
-  if (value === undefined) return fallback;
-  const n = Number(value);
-  return Number.isFinite(n) && n >= 0 ? n : fallback;
-}
-
-export function resolveClaudeDaemonConfig(env: NodeJS.ProcessEnv = process.env): ClaudeDaemonConfig {
-  const apiUrl = requireEnv(env, "PRLL_API_URL");
-  const apiKey = requireEnv(env, "PRLL_API_KEY");
-  if (!apiKey.startsWith("mck_")) {
-    // Fatal startup validation: the daemon must never run with an agent or
-    // human key because child launch credentials are minted from this bearer.
-    throw new Error(
-      `PRLL_API_KEY does not look like a Machine bearer (expected prefix "mck_"). ` +
-        `Daemon mode requires a machine-scoped key issued via POST /machines/{id}/keys.`,
-    );
-  }
-  const rootClaudeHome = resolvePath(env.PRLL_CLAUDE_HOME?.trim() || env.HOME || os.homedir());
-  const rootStateDir = resolvePath(env.PRLL_CLAUDE_STATE_DIR?.trim() || path.join(rootClaudeHome, ".parall-agent"));
-
-  return {
-    apiUrl,
-    apiKey,
-    agentBin: env.PRLL_CLAUDE_AGENT_BIN?.trim() || "parall-claude-agent",
-    rootStateDir,
-    rootClaudeHome,
-    wsUrl: env.PRLL_WS_URL?.trim() || undefined,
-    pollIntervalMs: parseMs(env.PRLL_DAEMON_POLL_INTERVAL_MS, 30_000),
-    heartbeatIntervalMs: parseMs(env.PRLL_DAEMON_HEARTBEAT_INTERVAL_MS, 30_000),
-    restartBackoffMs: parseMs(env.PRLL_DAEMON_RESTART_BACKOFF_MS, 5_000),
-    restartBackoffMaxMs: parseMs(env.PRLL_DAEMON_RESTART_BACKOFF_MAX_MS, 5 * 60_000),
-    bootstrapBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MS, 2_000),
-    bootstrapBackoffMaxMs: parseMs(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MAX_MS, 60_000),
-    supervisorRestartBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS, 5_000),
-    supervisorRestartBackoffMaxMs: parseMs(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MAX_MS, 5 * 60_000),
-  };
-}
-
-function assertSafeAgentId(agentId: string): string {
-  if (!/^[A-Za-z0-9_-]+$/.test(agentId)) {
-    throw new Error(`Invalid agentId for filesystem path: ${agentId}`);
-  }
-  return agentId;
-}
-
-/** Per-agent state dir under the shared host volume. */
-export function agentStateDirFor(rootStateDir: string, agentId: string): string {
-  return path.join(rootStateDir, "agents", assertSafeAgentId(agentId));
-}
-
-/** Per-agent HOME dir. Claude Code stores project/session state under
- * `${HOME}/.claude`, so each agent gets its own HOME root while the daemon
- * links shared OAuth credentials into that `.claude` directory. */
-export function agentClaudeHomeFor(rootClaudeHome: string, agentId: string): string {
-  return path.join(rootClaudeHome, "agents", assertSafeAgentId(agentId));
-}
-
-/** Shared Claude Code OAuth credential written by server-side runtime auth. */
-export function sharedClaudeCredentialsFileFor(rootClaudeHome: string): string {
-  return path.join(rootClaudeHome, ".claude", ".credentials.json");
-}
-
-/** Per-agent credential location inside that agent's isolated HOME. */
-export function agentClaudeCredentialsFileFor(agentClaudeHome: string): string {
-  return path.join(agentClaudeHome, ".claude", ".credentials.json");
-}
-
-/** Per-agent workspace dir where the agent runs git commands. */
-export function agentWorkspaceDirFor(rootStateDir: string, agentId: string): string {
-  return path.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
-}
-
-export function resolveWsUrl(apiUrl: string, explicitWsUrl?: string): string {
-  return explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
-}