@parall/daemon 1.29.0 → 1.29.2

package/bundle/parall-daemon.js

@@ -22,6 +22,8 @@ var ENDPOINTS = {
   AUTH_CHECK_EMAIL: `${API_BASE}/auth/check-email`,
   AUTH_VERIFY_EMAIL: `${API_BASE}/auth/verify-email`,
   AUTH_RESEND_CODE: `${API_BASE}/auth/resend-code`,
+  AUTH_FORGOT_PASSWORD: `${API_BASE}/auth/forgot-password`,
+  AUTH_RESET_PASSWORD: `${API_BASE}/auth/reset-password`,
   // Users
   USERS_ME: `${API_BASE}/users/me`,
   USER_AVATAR: `${API_BASE}/users/me/avatar`,
@@ -56,6 +58,9 @@ var ENDPOINTS = {
   // Messages (global, by message ID)
   MESSAGE: (id) => `${API_BASE}/messages/${id}`,
   MESSAGE_REPLIES: (id) => `${API_BASE}/messages/${id}/replies`,
+  MESSAGE_WATCH: (id) => `${API_BASE}/messages/${id}/watch`,
+  MESSAGE_WATCHERS: (id) => `${API_BASE}/messages/${id}/watchers`,
+  MESSAGE_WATCHING: (id) => `${API_BASE}/messages/${id}/watching`,
   // Upload (org-scoped)
   UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
   UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
@@ -106,6 +111,9 @@ var ENDPOINTS = {
   // Attach/Detach bind an agent to/from a daemon Machine.
   MACHINE_ATTACH_AGENT: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}`,
   MACHINE_DETACH_AGENT: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}`,
+  MACHINE_WORKSPACE_STATES: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/workspace-states`,
+  MACHINE_AGENT_DAEMON_CONFIG: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}/daemon-config`,
+  MACHINE_AGENT_WORKSPACE_SETUP: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}/workspace/setup`,
   MACHINE_LLM_SOURCE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/llm-source`,
   MACHINE_RUNTIME_AUTH: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth`,
   MACHINE_KEYS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/keys`,
@@ -119,6 +127,7 @@ var ENDPOINTS = {
   MACHINES_ME_AGENTS: `${API_BASE}/machines/me/agents`,
   MACHINES_ME_HEALTH: `${API_BASE}/machines/me/health`,
   MACHINES_ME_AGENT_LAUNCH_CREDENTIAL: (agentId) => `${API_BASE}/machines/me/agents/${agentId}/launch-credential`,
+  MACHINES_ME_AGENT_WORKSPACE_STATE: (agentId) => `${API_BASE}/machines/me/agents/${agentId}/workspace-state`,
   MACHINES_ME_WS_TICKET: `${API_BASE}/machines/me/ws/ticket`,
   // Tasks (org-scoped)
   TASKS: (orgId) => `${API_BASE}/orgs/${orgId}/tasks`,
@@ -298,7 +307,8 @@ var WS_EVENTS = {
   MACHINE_HELLO: "machine.hello",
   MACHINE_AGENT_ATTACHED: "machine.agent.attached",
   MACHINE_AGENT_DETACHED: "machine.agent.detached",
-  MACHINE_STOP: "machine.stop"
+  MACHINE_STOP: "machine.stop",
+  MACHINE_WORKSPACE_SETUP_REQUESTED: "machine.workspace.setup.requested"
 };
 
 // ts/sdk/dist/client.js
@@ -318,7 +328,9 @@ var ParallClient = class _ParallClient {
     "/auth/logout",
     "/auth/verify-email",
     "/auth/resend-code",
-    "/auth/check-email"
+    "/auth/check-email",
+    "/auth/forgot-password",
+    "/auth/reset-password"
   ]);
   /** Proactive refresh when token expires within this window (seconds). */
   static REFRESH_THRESHOLD_S = 5 * 60;
@@ -379,10 +391,10 @@ var ParallClient = class _ParallClient {
    * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
    * No-op when the token is still fresh, missing, or un-parseable.
    */
-  async ensureFreshToken(path5) {
+  async ensureFreshToken(path6) {
     if (!this.token || !this.getRefreshToken)
       return;
-    const pathSuffix = path5.replace(/^\/api\/v1/, "");
+    const pathSuffix = path6.replace(/^\/api\/v1/, "");
     if (_ParallClient.AUTH_PATHS.has(pathSuffix))
       return;
     const exp = _ParallClient.decodeJwtExp(this.token);
@@ -414,11 +426,11 @@ var ParallClient = class _ParallClient {
       this.refreshPromise = null;
     }
   }
-  async request(method, path5, body, query, retried = false, opts) {
+  async request(method, path6, body, query, retried = false, opts) {
     if (!retried) {
-      await this.ensureFreshToken(path5);
+      await this.ensureFreshToken(path6);
     }
-    let url = `${this.baseUrl}${path5}`;
+    let url = `${this.baseUrl}${path6}`;
     if (query) {
       const params = new URLSearchParams();
       for (const [key, value] of Object.entries(query)) {
@@ -443,12 +455,12 @@ var ParallClient = class _ParallClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path5.replace(/^\/api\/v1/, "");
+      const pathSuffix = path6.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.request(method, path5, body, query, true, opts);
+          return this.request(method, path6, body, query, true, opts);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -485,15 +497,15 @@ var ParallClient = class _ParallClient {
    * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
    * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
    */
-  async multipartRequest(method, path5, body, retried = false) {
+  async multipartRequest(method, path6, body, retried = false) {
     if (!retried) {
-      await this.ensureFreshToken(path5);
+      await this.ensureFreshToken(path6);
     }
     const { "Content-Type": _drop, ...headers } = this.buildHeaders();
     void _drop;
     let res;
     try {
-      res = await fetch(`${this.baseUrl}${path5}`, {
+      res = await fetch(`${this.baseUrl}${path6}`, {
         method,
         headers,
         body,
@@ -503,12 +515,12 @@ var ParallClient = class _ParallClient {
       throw _ParallClient.normalizeFetchError(err);
     }
     if (res.status === 401) {
-      const pathSuffix = path5.replace(/^\/api\/v1/, "");
+      const pathSuffix = path6.replace(/^\/api\/v1/, "");
       const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
       if (!retried && !isAuthPath && this.getRefreshToken) {
         const refreshed = await this.tryRefresh();
         if (refreshed) {
-          return this.multipartRequest(method, path5, body, true);
+          return this.multipartRequest(method, path6, body, true);
         }
       }
       if (this.onTokenExpired && !isAuthPath) {
@@ -556,6 +568,12 @@ var ParallClient = class _ParallClient {
   async resendCode(email) {
     return this.request("POST", ENDPOINTS.AUTH_RESEND_CODE, { email });
   }
+  async forgotPassword(email) {
+    return this.request("POST", ENDPOINTS.AUTH_FORGOT_PASSWORD, { email });
+  }
+  async resetPassword(token, newPassword) {
+    return this.request("POST", ENDPOINTS.AUTH_RESET_PASSWORD, { token, new_password: newPassword });
+  }
   // ---- WebSocket ----
   async getWsTicket() {
     return this.request("POST", ENDPOINTS.WS_TICKET);
@@ -762,8 +780,8 @@ var ParallClient = class _ParallClient {
   async completeUpload(orgId, attachmentId) {
     return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
   }
-  async getFileUrl(id) {
-    return this.request("GET", ENDPOINTS.FILE(id));
+  async getFileUrl(id, opts) {
+    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
   }
   // ---- Approvals ----
   async getApproval(id) {
@@ -960,6 +978,16 @@ var ParallClient = class _ParallClient {
   async detachAgent(orgId, machineId, agentId) {
     return this.request("DELETE", ENDPOINTS.MACHINE_DETACH_AGENT(orgId, machineId, agentId));
   }
+  async listAgentWorkspaceStates(orgId, machineId) {
+    const res = await this.request("GET", ENDPOINTS.MACHINE_WORKSPACE_STATES(orgId, machineId));
+    return res.data;
+  }
+  async patchAgentDaemonConfig(orgId, machineId, agentId, daemonConfig) {
+    return this.request("PATCH", ENDPOINTS.MACHINE_AGENT_DAEMON_CONFIG(orgId, machineId, agentId), { daemon_config: daemonConfig });
+  }
+  async retryAgentWorkspaceSetup(orgId, machineId, agentId) {
+    return this.request("POST", ENDPOINTS.MACHINE_AGENT_WORKSPACE_SETUP(orgId, machineId, agentId));
+  }
   async patchMachineLLMSource(orgId, machineId, llmSource2) {
     return this.request("PATCH", ENDPOINTS.MACHINE_LLM_SOURCE(orgId, machineId), { llm_source: llmSource2 });
   }
@@ -1005,6 +1033,12 @@ var ParallClient = class _ParallClient {
   async postMachineHeartbeat() {
     return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH);
   }
+  async reportAgentWorkspaceState(agentId, state) {
+    const res = await this.request("PUT", ENDPOINTS.MACHINES_ME_AGENT_WORKSPACE_STATE(agentId), state);
+    if (res?.status === "ignored_stale") {
+      throw new ApiError(409, "Workspace state report ignored as stale", "STALE_WORKSPACE_STATE");
+    }
+  }
   /**
    * `POST /machines/me/agents/{agentId}/launch-credential` — mint a
    * short-lived `agk_*` for one of this Machine's attached agents. The
@@ -1154,6 +1188,20 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.TASK_WATCHERS(orgId, taskId));
     return res.data;
   }
+  async watchThread(threadRootId) {
+    return this.request("POST", ENDPOINTS.MESSAGE_WATCH(threadRootId));
+  }
+  async unwatchThread(threadRootId) {
+    return this.request("DELETE", ENDPOINTS.MESSAGE_WATCH(threadRootId));
+  }
+  async getThreadWatchers(threadRootId) {
+    const res = await this.request("GET", ENDPOINTS.MESSAGE_WATCHERS(threadRootId));
+    return res.data;
+  }
+  async isWatchingThread(threadRootId) {
+    const res = await this.request("GET", ENDPOINTS.MESSAGE_WATCHING(threadRootId));
+    return res.watching;
+  }
   async getSubtasks(orgId, taskId) {
     const res = await this.request("GET", ENDPOINTS.TASK_SUBTASKS(orgId, taskId));
     return res.data;
@@ -1356,8 +1404,8 @@ var ParallClient = class _ParallClient {
   async deleteWikiPathScope(orgId, wikiId, scopeId) {
     await this.request("DELETE", ENDPOINTS.WIKI_PATH_SCOPE(orgId, wikiId, scopeId));
   }
-  async getWikiAccessStatus(orgId, wikiId, path5) {
-    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path5 ? { path: path5 } : void 0);
+  async getWikiAccessStatus(orgId, wikiId, path6) {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path6 ? { path: path6 } : void 0);
   }
   async createWikiAccessRequest(orgId, wikiId, data) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
@@ -1366,11 +1414,11 @@ var ParallClient = class _ParallClient {
   async getWikiCommits(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
   }
-  async getWikiFileCommits(orgId, wikiId, path5, params) {
-    return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, { path: path5, ...params });
+  async getWikiFileCommits(orgId, wikiId, path6, params) {
+    return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, { path: path6, ...params });
   }
-  async getWikiBlame(orgId, wikiId, path5, ref) {
-    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path5, ref });
+  async getWikiBlame(orgId, wikiId, path6, ref) {
+    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path6, ref });
   }
   // ---- Wiki Operations (audit log) ----
   async getWikiOperations(orgId, wikiId, params) {
@@ -1450,14 +1498,28 @@ var ParallClient = class _ParallClient {
       params.set("machine_id", opts.machine_id);
     if (opts?.unresolved_machine)
       params.set("unresolved_machine", "true");
+    if (opts?.from)
+      params.set("from", opts.from);
+    if (opts?.to)
+      params.set("to", opts.to);
     const qs = params.toString();
     return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}${qs ? `?${qs}` : ""}`);
   }
-  async listBillingTransactionAgentGroups(orgId) {
-    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?group_by=agent`);
-  }
-  async listBillingTransactionMachineGroups(orgId) {
-    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?group_by=machine`);
+  async listBillingTransactionAgentGroups(orgId, opts) {
+    const params = new URLSearchParams({ group_by: "agent" });
+    if (opts?.from)
+      params.set("from", opts.from);
+    if (opts?.to)
+      params.set("to", opts.to);
+    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?${params}`);
+  }
+  async listBillingTransactionMachineGroups(orgId, opts) {
+    const params = new URLSearchParams({ group_by: "machine" });
+    if (opts?.from)
+      params.set("from", opts.from);
+    if (opts?.to)
+      params.set("to", opts.to);
+    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?${params}`);
   }
   async createCheckout(orgId, req) {
     return this.request("POST", ENDPOINTS.BILLING_CHECKOUT(orgId), req);
@@ -1508,6 +1570,12 @@ var ApiError = class extends Error {
 };
 
 // ts/sdk/dist/ws.js
+function isRetryableNetworkError(err) {
+  return err instanceof Error && err.name === "ApiError" && "status" in err && err.status === 0;
+}
+function isBrowserRuntime() {
+  return typeof window !== "undefined";
+}
 var ParallWs = class {
   ws = null;
   options;
@@ -1543,7 +1611,11 @@ var ParallWs = class {
     try {
       ticket = await this.options.getTicket();
     } catch (err) {
-      console.error("Failed to get WS ticket:", err);
+      if (isBrowserRuntime() && isRetryableNetworkError(err)) {
+        console.warn("Failed to get WS ticket:", err);
+      } else {
+        console.error("Failed to get WS ticket:", err);
+      }
       if (this.options.reconnect) {
         this.scheduleReconnect();
       } else {
@@ -1901,6 +1973,7 @@ function resolveClaudeDaemonConfig(env = process.env) {
     rootStateDir,
     rootClaudeHome,
     wsUrl: env.PRLL_WS_URL?.trim() || void 0,
+    swimlaneName: env.PRLL_SWIMLANE_NAME?.trim() || void 0,
     pollIntervalMs: parseMs(env.PRLL_DAEMON_POLL_INTERVAL_MS, 3e4),
     heartbeatIntervalMs: parseMs(env.PRLL_DAEMON_HEARTBEAT_INTERVAL_MS, 3e4),
     restartBackoffMs: parseMs(env.PRLL_DAEMON_RESTART_BACKOFF_MS, 5e3),
@@ -1932,14 +2005,19 @@ function agentClaudeCredentialsFileFor(agentClaudeHome) {
 function agentWorkspaceDirFor(rootStateDir, agentId) {
   return path.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
 }
-function resolveWsUrl(apiUrl, explicitWsUrl) {
-  return explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
+function resolveWsUrl(apiUrl, explicitWsUrl, swimlaneName) {
+  const base = explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
+  if (!swimlaneName)
+    return base;
+  const url = new URL(base);
+  url.searchParams.set("swimlane", swimlaneName);
+  return url.toString();
 }
 
 // ts/daemon/dist/supervisor.js
-import { spawn } from "node:child_process";
-import * as fs2 from "node:fs";
-import * as path3 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+import * as fs3 from "node:fs";
+import * as path4 from "node:path";
 
 // ts/daemon/dist/runtimes.js
 import * as path2 from "node:path";
@@ -2058,23 +2136,451 @@ function assertAgentKey(apiKey) {
   }
 }
 
+// ts/daemon/dist/workspace.js
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as path3 from "node:path";
+var OUTPUT_TAIL_LIMIT = 32 * 1024;
+var DEFAULT_SETUP_TIMEOUT_SEC = 600;
+async function prepareWorkspace(opts) {
+  const prior = opts.attached.workspace_state;
+  const plan = buildWorkspacePlan(opts.attached.daemon_config, opts.defaultWorkspaceDir, prior?.config_hash);
+  if (!opts.attached.daemon_config && !prior) {
+    return plan.workspaceDir;
+  }
+  let forceSetup = false;
+  if (prior?.status === "ready" && prior.config_hash === plan.configHash) {
+    if (await verifyExistingWorkspace(plan, opts.log)) {
+      return plan.workspaceDir;
+    }
+    forceSetup = true;
+  }
+  await opts.client.reportAgentWorkspaceState(opts.agentId, {
+    config_hash: plan.configHash,
+    status: "preparing"
+  });
+  let outputTail = "";
+  try {
+    await ensureWorkspace(plan, opts.log);
+    if (shouldRunSetup(plan.workspace.setup, prior, plan.configHash, forceSetup)) {
+      outputTail = await runSetup(plan.workspaceDir, plan.workspace.setup.command, plan.workspace.setup?.timeout_sec);
+    }
+    await opts.client.reportAgentWorkspaceState(opts.agentId, {
+      config_hash: plan.configHash,
+      status: "ready",
+      output_tail: outputTail || null
+    });
+    return plan.workspaceDir;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await opts.client.reportAgentWorkspaceState(opts.agentId, {
+      config_hash: plan.configHash,
+      status: "failed",
+      last_error: message,
+      output_tail: outputTail || null
+    }).catch((reportErr) => {
+      opts.log.warn(`workspace state report failed after setup error: ${String(reportErr)}`);
+    });
+    throw err;
+  }
+}
+function buildWorkspacePlan(input, defaultWorkspaceDir, serverConfigHash) {
+  const config = normalizeConfig(input, defaultWorkspaceDir);
+  const workspace = config.workspace;
+  const { workspaceDir, customWorkspaceField } = resolveWorkspaceDir(workspace, defaultWorkspaceDir);
+  const configHash = serverConfigHash || createHash("sha256").update(JSON.stringify(config)).digest("hex");
+  return { config, workspace, workspaceDir, defaultWorkspaceDir, customWorkspaceField, configHash };
+}
+function normalizeConfig(input, defaultWorkspaceDir) {
+  const cfg = input ? JSON.parse(JSON.stringify(input)) : {};
+  cfg.workspace_path = cfg.workspace_path?.trim() || void 0;
+  if (!cfg.workspace && cfg.workspace_path) {
+    cfg.workspace = { mode: "local_path", path: cfg.workspace_path };
+  }
+  if (!cfg.workspace) {
+    cfg.workspace = { mode: "default" };
+  }
+  const ws = cfg.workspace;
+  ws.mode = ws.mode?.trim() || void 0;
+  ws.path = ws.path?.trim() || void 0;
+  if (ws.git) {
+    ws.git.remote = ws.git.remote?.trim() || void 0;
+    ws.git.ref = ws.git.ref?.trim() || void 0;
+    ws.git.target_path = ws.git.target_path?.trim() || void 0;
+  }
+  ws.mode ||= ws.git ? "git" : ws.path ? "local_path" : "default";
+  if (ws.mode === "local_path" && !ws.path) {
+    ws.mode = "default";
+  }
+  if (ws.mode === "git") {
+    ws.git ||= {};
+    if (!ws.git.target_path && ws.path) {
+      ws.git.target_path = ws.path;
+    }
+  }
+  if (ws.mode === "default") {
+    ws.path = void 0;
+    ws.git = void 0;
+  }
+  if (ws.mode === "local_path") {
+    ws.git = void 0;
+  }
+  if (ws.setup) {
+    ws.setup.command = ws.setup.command?.trim();
+    ws.setup.run_on ||= "first_attach";
+    if (!ws.setup.command) {
+      ws.setup = void 0;
+    }
+  }
+  void defaultWorkspaceDir;
+  return cfg;
+}
+function resolveWorkspaceDir(workspace, defaultWorkspaceDir) {
+  if (workspace.mode === "local_path") {
+    if (!workspace.path)
+      return { workspaceDir: defaultWorkspaceDir };
+    return {
+      workspaceDir: requireAbsolute(workspace.path, "workspace.path"),
+      customWorkspaceField: "workspace.path"
+    };
+  }
+  if (workspace.mode === "git") {
+    return workspace.git?.target_path ? {
+      workspaceDir: requireAbsolute(workspace.git.target_path, "workspace.git.target_path"),
+      customWorkspaceField: "workspace.git.target_path"
+    } : { workspaceDir: defaultWorkspaceDir };
+  }
+  return { workspaceDir: defaultWorkspaceDir };
+}
+async function ensureWorkspace(plan, log2) {
+  const ws = plan.workspace;
+  if (ws.mode === "default") {
+    fs2.mkdirSync(plan.workspaceDir, { recursive: true });
+    assertWritableWorkspaceDir(plan.workspaceDir);
+    return;
+  }
+  if (ws.mode === "local_path") {
+    assertSafeCustomWorkspacePath(plan);
+    let st;
+    try {
+      st = fs2.statSync(plan.workspaceDir);
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT") {
+        throw new Error(`workspace path does not exist: ${plan.workspaceDir}`);
+      }
+      throw err;
+    }
+    if (!st.isDirectory()) {
+      throw new Error(`workspace path is not a directory: ${plan.workspaceDir}`);
+    }
+    assertSafeCustomWorkspacePath(plan, fs2.realpathSync(plan.workspaceDir));
+    assertWritableWorkspaceDir(plan.workspaceDir);
+    return;
+  }
+  if (ws.mode === "git") {
+    const remote = ws.git?.remote?.trim();
+    if (!remote)
+      throw new Error("workspace git remote is required");
+    if (plan.customWorkspaceField) {
+      assertSafeCustomWorkspacePath(plan);
+    }
+    if (!fs2.existsSync(plan.workspaceDir)) {
+      fs2.mkdirSync(path3.dirname(plan.workspaceDir), { recursive: true });
+      assertWritableWorkspaceDir(path3.dirname(plan.workspaceDir));
+      await runCommand("git", ["clone", remote, plan.workspaceDir], process.cwd());
+    } else {
+      const st = fs2.statSync(plan.workspaceDir);
+      if (!st.isDirectory()) {
+        throw new Error(`workspace path is not a directory: ${plan.workspaceDir}`);
+      }
+      if (plan.customWorkspaceField) {
+        assertSafeCustomWorkspacePath(plan, fs2.realpathSync(plan.workspaceDir));
+      }
+      assertWritableWorkspaceDir(plan.workspaceDir);
+      await ensureGitWorktree(plan.workspaceDir);
+      await ensureGitRemote(plan.workspaceDir, remote);
+    }
+    if (ws.git?.ref) {
+      const dirty = await commandOutput("git", ["status", "--porcelain"], plan.workspaceDir);
+      if (dirty.trim()) {
+        throw new Error(`workspace git tree has local changes; refusing checkout: ${plan.workspaceDir}`);
+      }
+      await runCommand("git", ["fetch", "origin", "--prune"], plan.workspaceDir);
+      await checkoutGitRef(plan.workspaceDir, ws.git.ref);
+    }
+    log2.info(`workspace ready: git ${remote} -> ${plan.workspaceDir}`);
+    return;
+  }
+  throw new Error(`unsupported workspace mode: ${ws.mode ?? "(empty)"}`);
+}
+async function verifyExistingWorkspace(plan, log2) {
+  try {
+    if (plan.customWorkspaceField) {
+      assertSafeCustomWorkspacePath(plan);
+    }
+    const st = fs2.statSync(plan.workspaceDir);
+    if (!st.isDirectory()) {
+      log2.warn(`workspace ready state ignored: path is not a directory: ${plan.workspaceDir}`);
+      return false;
+    }
+    if (plan.customWorkspaceField) {
+      assertSafeCustomWorkspacePath(plan, fs2.realpathSync(plan.workspaceDir));
+    }
+    assertWritableWorkspaceDir(plan.workspaceDir);
+    if (plan.workspace.mode === "git") {
+      await ensureGitWorktree(plan.workspaceDir);
+      const remote = plan.workspace.git?.remote?.trim();
+      if (remote) {
+        await ensureGitRemote(plan.workspaceDir, remote);
+      }
+      if (plan.workspace.git?.ref) {
+        const head = (await commandOutput("git", ["rev-parse", "HEAD"], plan.workspaceDir)).trim();
+        const expected = await resolveConfiguredGitRef(plan.workspaceDir, plan.workspace.git.ref);
+        if (head !== expected) {
+          log2.warn(`workspace ready state ignored: git HEAD ${head} does not match ${plan.workspace.git.ref} (${expected})`);
+          return false;
+        }
+      }
+    }
+    return true;
+  } catch (err) {
+    log2.warn(`workspace ready state ignored: ${String(err)}`);
+    return false;
+  }
+}
+async function ensureGitWorktree(cwd) {
+  const result = await commandOutput("git", ["rev-parse", "--is-inside-work-tree"], cwd);
+  if (result.trim() !== "true") {
+    throw new Error(`workspace path exists but is not a git worktree: ${cwd}`);
+  }
+}
+async function ensureGitRemote(cwd, expectedRemote) {
+  const actualRemote = (await commandOutput("git", ["remote", "get-url", "origin"], cwd)).trim();
+  if (actualRemote !== expectedRemote) {
+    throw new Error(`workspace git remote mismatch: expected ${expectedRemote}, got ${actualRemote}`);
+  }
+}
+async function checkoutGitRef(cwd, ref) {
+  const remoteCommit = await resolveRemoteGitRef(cwd, ref);
+  if (remoteCommit) {
+    await runCommand("git", ["checkout", "-B", ref, remoteCommit], cwd);
+    return;
+  }
+  const targetCommit = await resolveGitCommit(cwd, ref);
+  await runCommand("git", ["checkout", "--detach", targetCommit], cwd);
+}
+async function resolveConfiguredGitRef(cwd, ref) {
+  const remote = await resolveRemoteGitRef(cwd, ref);
+  return remote || await resolveGitCommit(cwd, ref);
+}
+async function resolveRemoteGitRef(cwd, ref) {
+  return (await tryGitOutput("git", ["rev-parse", "--verify", `refs/remotes/origin/${ref}^{commit}`], cwd)).trim();
+}
+async function resolveGitCommit(cwd, ref) {
+  const candidates = [`refs/tags/${ref}^{commit}`, `${ref}^{commit}`];
+  for (const candidate of candidates) {
+    const commit = await tryGitOutput("git", ["rev-parse", "--verify", candidate], cwd);
+    if (commit.trim()) {
+      return commit.trim();
+    }
+  }
+  throw new Error(`workspace git ref not found: ${ref}`);
+}
+function shouldRunSetup(setup, prior, configHash, forceSetup = false) {
+  if (!setup?.command)
+    return false;
+  if (forceSetup)
+    return true;
+  if (setup.run_on === "config_change") {
+    return prior?.config_hash !== configHash || prior.status === "pending" || prior.status === "failed";
+  }
+  return prior?.status !== "ready" || !prior.prepared_at;
+}
+async function runSetup(cwd, command, timeoutSec) {
+  const effectiveTimeoutSec = timeoutSec && timeoutSec > 0 ? timeoutSec : DEFAULT_SETUP_TIMEOUT_SEC;
+  return runCommand(process.env.SHELL || "/bin/sh", ["-lc", command], cwd, effectiveTimeoutSec * 1e3, scrubSetupEnv());
+}
+function scrubSetupEnv() {
+  const env = { ...process.env };
+  clearAllProviderCreds(env);
+  delete env.PRLL_API_KEY;
+  return env;
+}
+async function commandOutput(cmd, args, cwd) {
+  return runCommand(cmd, args, cwd);
+}
+async function tryGitOutput(cmd, args, cwd) {
+  try {
+    return await runCommand(cmd, args, cwd);
+  } catch {
+    return "";
+  }
+}
+function runCommand(cmd, args, cwd, timeoutMs = 12e4, env = process.env) {
+  return new Promise((resolve4, reject) => {
+    let tail = "";
+    let timedOut = false;
+    let settled = false;
+    let timeoutTimer = null;
+    let killTimer = null;
+    const append = (chunk) => {
+      tail += chunk.toString();
+      if (tail.length > OUTPUT_TAIL_LIMIT) {
+        tail = tail.slice(-OUTPUT_TAIL_LIMIT);
+      }
+    };
+    const settle = (fn) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timeoutTimer)
+        clearTimeout(timeoutTimer);
+      if (killTimer)
+        clearTimeout(killTimer);
+      fn();
+    };
+    const child = spawn(cmd, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    timeoutTimer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => {
+        child.kill("SIGKILL");
+      }, 5e3);
+    }, timeoutMs);
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", append);
+    child.once("error", (err) => {
+      settle(() => reject(err));
+    });
+    child.once("close", (code, signal) => {
+      if (timedOut) {
+        settle(() => reject(new Error(`command timed out after ${timeoutMs}ms: ${cmd} ${args.join(" ")}
+${tail}`)));
+        return;
+      }
+      if (code === 0) {
+        settle(() => resolve4(tail));
+      } else {
+        settle(() => reject(new Error(`command failed (${code ?? signal}): ${cmd} ${args.join(" ")}
+${tail}`)));
+      }
+    });
+  });
+}
+function requireAbsolute(value, field) {
+  if (!value || !path3.isAbsolute(value)) {
+    throw new Error(`${field} must be an absolute path`);
+  }
+  return path3.resolve(value);
+}
+function assertSafeCustomWorkspacePath(plan, candidate = plan.workspaceDir) {
+  if (!plan.customWorkspaceField)
+    return;
+  const normalized = requireAbsolute(candidate, plan.customWorkspaceField);
+  const reason = workspacePathDenyReason(toPolicyPath(normalized));
+  if (reason) {
+    throw new Error(`${plan.customWorkspaceField} must point to a project folder, not ${reason}: ${normalized}`);
+  }
+  const defaultWorkspace = path3.resolve(plan.defaultWorkspaceDir);
+  if (isAncestorPath(normalized, defaultWorkspace) || normalized === defaultWorkspace) {
+    throw new Error(`${plan.customWorkspaceField} must not point at daemon state directories: ${normalized}`);
+  }
+}
+function assertWritableWorkspaceDir(dir) {
+  fs2.accessSync(dir, fs2.constants.R_OK | fs2.constants.W_OK | fs2.constants.X_OK);
+  const probe = path3.join(dir, `.parall-workspace-check-${process.pid}-${Date.now()}`);
+  const fd = fs2.openSync(probe, "wx", 384);
+  fs2.closeSync(fd);
+  fs2.unlinkSync(probe);
+}
+function workspacePathDenyReason(value) {
+  if (value === "/")
+    return "the filesystem root";
+  if (["/tmp", "/private/tmp", "/var/tmp", "/Users", "/home"].includes(value)) {
+    return "a shared or home root directory";
+  }
+  for (const root of [
+    "/Applications",
+    "/bin",
+    "/boot",
+    "/dev",
+    "/etc",
+    "/Library",
+    "/private/etc",
+    "/private/var/db",
+    "/proc",
+    "/root",
+    "/run",
+    "/sbin",
+    "/System",
+    "/sys",
+    "/usr",
+    "/var/db",
+    "/var/root"
+  ]) {
+    if (value === root || value.startsWith(`${root}/`)) {
+      return "a system directory";
+    }
+  }
+  const parts = value.split("/").filter(Boolean);
+  if (parts.includes(".git"))
+    return "a git metadata directory";
+  if (parts.length === 2 && (parts[0] === "Users" || parts[0] === "home")) {
+    return "a home directory";
+  }
+  if (parts.length >= 3 && (parts[0] === "Users" || parts[0] === "home")) {
+    const homeChild = parts[2];
+    if ([
+      ".aws",
+      ".azure",
+      ".claude",
+      ".codex",
+      ".config",
+      ".docker",
+      ".gnupg",
+      ".kube",
+      ".local",
+      ".npm",
+      ".ssh",
+      ".parall-agent",
+      ".parall-daemon",
+      "Library"
+    ].includes(homeChild)) {
+      return "a credential or application state directory";
+    }
+  }
+  return "";
+}
+function isAncestorPath(parent, child) {
+  const relative2 = path3.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
+}
+function toPolicyPath(value) {
+  return path3.resolve(value).split(path3.sep).join("/");
+}
+function isNodeError(err) {
+  return err instanceof Error && "code" in err;
+}
+
 // ts/daemon/dist/supervisor.js
 var RUNTIME_PACKAGES = {
   "claude-code": "@parall/claude-agent",
   "codex": "@parall/codex-agent",
   "openclaw": "@parall/openclaw-agent"
 };
+var WORKSPACE_SETUP_RETRY_DELAY_MS = 5e3;
 function sleepCancellable(ms, signal) {
   if (signal.aborted)
     return Promise.resolve(false);
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve3(true);
+      resolve4(true);
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
-      resolve3(false);
+      resolve4(false);
     };
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -2084,6 +2590,10 @@ var DaemonSupervisor = class {
   client;
   log;
   children = /* @__PURE__ */ new Map();
+  spawningAgents = /* @__PURE__ */ new Set();
+  pendingWorkspaceSetup = /* @__PURE__ */ new Set();
+  workspaceSetupRetryTimers = /* @__PURE__ */ new Map();
+  cancelledSpawns = /* @__PURE__ */ new Set();
   ws = null;
   running = false;
   machineOrgId = null;
@@ -2144,6 +2654,10 @@ var DaemonSupervisor = class {
         void this.respawnAllChildren();
       }
     });
+    this.ws.on("machine.workspace.setup.requested", (data) => {
+      this.log.info(`WS: workspace setup requested for agent ${data.agent_id}`);
+      void this.handleWorkspaceSetupRequested(data.agent_id);
+    });
     this.ws.on("machine.stop", (data) => {
       this.log.info(`WS: machine.stop received (reason=${data.reason ?? "none"})`);
       void this.stop();
@@ -2154,8 +2668,8 @@ var DaemonSupervisor = class {
       }
     });
     await this.ws.connect();
-    await new Promise((resolve3) => {
-      this.stopResolve = resolve3;
+    await new Promise((resolve4) => {
+      this.stopResolve = resolve4;
     });
     signal.removeEventListener("abort", onAbort);
   }
@@ -2169,6 +2683,10 @@ var DaemonSupervisor = class {
       this.ws = null;
     }
     const exits = [];
+    for (const timer of this.workspaceSetupRetryTimers.values()) {
+      clearTimeout(timer);
+    }
+    this.workspaceSetupRetryTimers.clear();
     for (const state of this.children.values()) {
       state.shuttingDown = true;
       if (state.restartTimer) {
@@ -2270,15 +2788,15 @@ var DaemonSupervisor = class {
    */
   migrateFlatLayout() {
     const root = this.config.rootStateDir;
-    const agentsDir = path3.join(root, "agents");
-    const flatWorkspace = path3.join(root, "workspace");
-    if (!fs2.existsSync(flatWorkspace) || fs2.existsSync(agentsDir))
+    const agentsDir = path4.join(root, "agents");
+    const flatWorkspace = path4.join(root, "workspace");
+    if (!fs3.existsSync(flatWorkspace) || fs3.existsSync(agentsDir))
       return;
     let ownerAgentId;
-    const sessionsDir = path3.join(root, "sessions");
-    if (fs2.existsSync(sessionsDir)) {
+    const sessionsDir = path4.join(root, "sessions");
+    if (fs3.existsSync(sessionsDir)) {
       try {
-        for (const file of fs2.readdirSync(sessionsDir)) {
+        for (const file of fs3.readdirSync(sessionsDir)) {
           if (!file.endsWith(".json"))
             continue;
           const decoded = Buffer.from(file.replace(".json", ""), "base64url").toString();
@@ -2292,13 +2810,13 @@ var DaemonSupervisor = class {
       }
     }
     const targetId = ownerAgentId ?? "_orphan";
-    const targetDir = path3.join(agentsDir, targetId);
+    const targetDir = path4.join(agentsDir, targetId);
     try {
-      fs2.mkdirSync(targetDir, { recursive: true });
+      fs3.mkdirSync(targetDir, { recursive: true });
       for (const sub of ["workspace", "sessions", "dispatch-context"]) {
-        const src = path3.join(root, sub);
-        if (fs2.existsSync(src)) {
-          fs2.renameSync(src, path3.join(targetDir, sub));
+        const src = path4.join(root, sub);
+        if (fs3.existsSync(src)) {
+          fs3.renameSync(src, path4.join(targetDir, sub));
         }
       }
       this.log.info(`migrated legacy flat state \u2192 agents/${targetId}/`);
@@ -2307,23 +2825,30 @@ var DaemonSupervisor = class {
     }
   }
   // ---- WS event handlers (incremental) ----
-  async handleAgentAttached(agentId) {
-    if (this.children.has(agentId))
-      return;
+  async fetchAttachedAgent(agentId) {
     let attached;
     try {
       attached = await this.client.listAttachedAgents();
     } catch (err) {
-      this.log.warn(`handleAgentAttached: listAttachedAgents failed: ${String(err)}`);
-      return;
+      this.log.warn(`fetchAttachedAgent: listAttachedAgents failed: ${String(err)}`);
+      return { kind: "retryable" };
     }
     const entry = attached.find((a) => (a.user?.id ?? a.profile.user_id) === agentId);
     if (!entry) {
-      this.log.warn(`handleAgentAttached: agent ${agentId} not found in attached list`);
-      return;
+      this.log.warn(`fetchAttachedAgent: agent ${agentId} not found in attached list`);
+      return { kind: "skip" };
     }
     if (entry.user && entry.user.status !== "active") {
       this.log.info(`agent ${agentId} not active (status=${entry.user.status}) \u2014 skipping`);
+      return { kind: "skip" };
+    }
+    return { kind: "found", entry };
+  }
+  async handleAgentAttached(agentId) {
+    if (this.children.has(agentId) || this.spawningAgents.has(agentId))
+      return;
+    const result = await this.fetchAttachedAgent(agentId);
+    if (result.kind !== "found") {
       return;
     }
     const orgId = this.machineOrgId;
@@ -2331,9 +2856,14 @@ var DaemonSupervisor = class {
       this.log.warn(`agent ${agentId}: no org_id available yet; skipping`);
       return;
     }
-    await this.spawnAgent(agentId, orgId, entry);
+    await this.spawnAgent(agentId, orgId, result.entry);
   }
   async handleAgentDetached(agentId) {
+    this.pendingWorkspaceSetup.delete(agentId);
+    this.clearWorkspaceSetupRetry(agentId);
+    if (this.spawningAgents.has(agentId)) {
+      this.cancelledSpawns.add(agentId);
+    }
     const state = this.children.get(agentId);
     if (!state)
       return;
@@ -2346,6 +2876,61 @@ var DaemonSupervisor = class {
     await this.terminateChild(state);
     this.children.delete(agentId);
   }
+  async handleWorkspaceSetupRequested(agentId) {
+    if (this.spawningAgents.has(agentId)) {
+      this.log.info(`agent ${agentId}: workspace setup already in progress; queueing one restart`);
+      this.pendingWorkspaceSetup.add(agentId);
+      return;
+    }
+    const result = await this.fetchAttachedAgent(agentId);
+    if (result.kind === "retryable") {
+      this.pendingWorkspaceSetup.add(agentId);
+      this.scheduleWorkspaceSetupRetry(agentId);
+      return;
+    }
+    if (result.kind === "skip") {
+      this.pendingWorkspaceSetup.delete(agentId);
+      this.clearWorkspaceSetupRetry(agentId);
+      return;
+    }
+    this.clearWorkspaceSetupRetry(agentId);
+    const state = this.children.get(agentId);
+    if (state) {
+      this.log.info(`agent ${agentId}: restarting for workspace setup`);
+      state.shuttingDown = true;
+      if (state.restartTimer) {
+        clearTimeout(state.restartTimer);
+        state.restartTimer = null;
+      }
+      await this.terminateChild(state);
+      this.children.delete(agentId);
+    }
+    const orgId = this.machineOrgId;
+    if (!orgId) {
+      this.log.warn(`agent ${agentId}: no org_id available yet; skipping`);
+      return;
+    }
+    await this.spawnAgent(agentId, orgId, result.entry);
+  }
+  scheduleWorkspaceSetupRetry(agentId) {
+    if (!this.running || this.workspaceSetupRetryTimers.has(agentId))
+      return;
+    const timer = setTimeout(() => {
+      this.workspaceSetupRetryTimers.delete(agentId);
+      if (this.running && this.pendingWorkspaceSetup.has(agentId)) {
+        void this.handleWorkspaceSetupRequested(agentId);
+      }
+    }, WORKSPACE_SETUP_RETRY_DELAY_MS);
+    timer.unref?.();
+    this.workspaceSetupRetryTimers.set(agentId, timer);
+  }
+  clearWorkspaceSetupRetry(agentId) {
+    const timer = this.workspaceSetupRetryTimers.get(agentId);
+    if (timer) {
+      clearTimeout(timer);
+      this.workspaceSetupRetryTimers.delete(agentId);
+    }
+  }
   // ---- Spawn / restart ----
   async refreshMachineConfig() {
     try {
@@ -2385,6 +2970,25 @@ var DaemonSupervisor = class {
     }
   }
   async spawnAgent(agentId, orgId, attached) {
+    if (this.children.has(agentId) || this.spawningAgents.has(agentId)) {
+      return;
+    }
+    this.spawningAgents.add(agentId);
+    let shouldReplaySetupRequest = false;
+    try {
+      await this.spawnAgentOnce(agentId, orgId, attached);
+    } finally {
+      this.spawningAgents.delete(agentId);
+      this.cancelledSpawns.delete(agentId);
+      shouldReplaySetupRequest = this.pendingWorkspaceSetup.delete(agentId);
+    }
+    if (shouldReplaySetupRequest && this.running) {
+      queueMicrotask(() => {
+        void this.handleWorkspaceSetupRequested(agentId);
+      });
+    }
+  }
+  async spawnAgentOnce(agentId, orgId, attached) {
     let credential;
     try {
       credential = await this.client.mintLaunchCredential(agentId);
@@ -2393,22 +2997,36 @@ var DaemonSupervisor = class {
       return;
     }
     const stateDir = agentStateDirFor(this.config.rootStateDir, agentId);
-    const workspaceDir = attached.daemon_config?.workspace_path || agentWorkspaceDirFor(this.config.rootStateDir, agentId);
+    const defaultWorkspaceDir = agentWorkspaceDirFor(this.config.rootStateDir, agentId);
     const isK8s = !!process.env.KUBERNETES_SERVICE_HOST;
     const claudeHome = isK8s ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId) : this.config.rootClaudeHome;
     try {
-      fs2.mkdirSync(stateDir, { recursive: true });
-      if (!attached.daemon_config?.workspace_path) {
-        fs2.mkdirSync(workspaceDir, { recursive: true });
-      }
+      fs3.mkdirSync(stateDir, { recursive: true });
       if (isK8s) {
-        fs2.mkdirSync(claudeHome, { recursive: true });
+        fs3.mkdirSync(claudeHome, { recursive: true });
         this.ensureSharedCredentialLink(claudeHome, agentId);
       }
     } catch (err) {
       this.log.warn(`mkdir agent dirs (${agentId}) failed: ${String(err)}`);
     }
     const runtimeType = attached.profile.runtime_type ?? "claude-code";
+    let workspaceDir;
+    try {
+      workspaceDir = await prepareWorkspace({
+        client: this.client,
+        attached,
+        agentId,
+        defaultWorkspaceDir,
+        log: this.log
+      });
+    } catch (err) {
+      this.log.error(`agent ${agentId}: workspace setup failed: ${String(err)}`);
+      return;
+    }
+    if (this.cancelledSpawns.delete(agentId)) {
+      this.log.info(`agent ${agentId}: spawn cancelled after detach during workspace setup`);
+      return;
+    }
     const state = {
       agentId,
       orgId,
@@ -2441,7 +3059,7 @@ var DaemonSupervisor = class {
     };
     const env = adapter.buildEnv({ ...process.env, PRLL_API_URL: this.config.apiUrl }, state.agentId, state.orgId, state.credential.api_key, dirs, state.providerConfig);
     this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} bin=${adapter.bin} (attempt ${state.restartAttempts + 1})`);
-    const child = spawn(adapter.bin, [], {
+    const child = spawn2(adapter.bin, [], {
       env,
       stdio: ["ignore", "inherit", "inherit"],
       detached: false
@@ -2479,25 +3097,26 @@ var DaemonSupervisor = class {
       settleChild("error", null, null, err);
     });
     child.once("close", (code, signal) => settleChild("close", code, signal));
-    setTimeout(() => {
+    const stableTimer = setTimeout(() => {
       if (state.child === child) {
         state.restartAttempts = 0;
       }
     }, Math.max(this.config.restartBackoffMs, 3e4));
+    stableTimer.unref?.();
   }
   async terminateChild(state) {
     const child = state.child;
     if (!child)
       return;
-    return new Promise((resolve3) => {
-      const onExit = () => resolve3();
+    return new Promise((resolve4) => {
+      const onExit = () => resolve4();
       child.once("exit", onExit);
       try {
         child.kill("SIGTERM");
       } catch (err) {
         this.log.warn(`SIGTERM ${state.agentId} threw: ${String(err)}`);
         child.off("exit", onExit);
-        resolve3();
+        resolve4();
         return;
       }
       const hardKill = setTimeout(() => {
@@ -2510,60 +3129,60 @@ var DaemonSupervisor = class {
     });
   }
   ensureSharedCredentialLink(agentClaudeHome, agentId) {
-    const sharedCredentials = path3.resolve(sharedClaudeCredentialsFileFor(this.config.rootClaudeHome));
+    const sharedCredentials = path4.resolve(sharedClaudeCredentialsFileFor(this.config.rootClaudeHome));
     const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
-    const agentCredentialsDir = path3.dirname(agentCredentials);
-    fs2.mkdirSync(path3.dirname(sharedCredentials), { recursive: true });
-    fs2.mkdirSync(agentCredentialsDir, { recursive: true });
+    const agentCredentialsDir = path4.dirname(agentCredentials);
+    fs3.mkdirSync(path4.dirname(sharedCredentials), { recursive: true });
+    fs3.mkdirSync(agentCredentialsDir, { recursive: true });
     try {
-      const existing = fs2.lstatSync(agentCredentials);
+      const existing = fs3.lstatSync(agentCredentials);
       if (existing.isSymbolicLink()) {
-        const currentTarget = fs2.readlinkSync(agentCredentials);
-        if (path3.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
+        const currentTarget = fs3.readlinkSync(agentCredentials);
+        if (path4.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
           return;
         }
-        fs2.unlinkSync(agentCredentials);
+        fs3.unlinkSync(agentCredentials);
       } else if (existing.isDirectory()) {
         this.log.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
         return;
       } else {
-        fs2.unlinkSync(agentCredentials);
+        fs3.unlinkSync(agentCredentials);
       }
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw err;
       }
     }
-    fs2.symlinkSync(sharedCredentials, agentCredentials);
+    fs3.symlinkSync(sharedCredentials, agentCredentials);
   }
 };
 
 // ts/daemon/dist/cli.js
-import * as fs3 from "node:fs";
-import * as path4 from "node:path";
+import * as fs4 from "node:fs";
+import * as path5 from "node:path";
 import * as os2 from "node:os";
 import * as readline from "node:readline";
-import { spawn as spawn2, execSync } from "node:child_process";
+import { spawn as spawn3, execSync } from "node:child_process";
 var CONFIG_DIR = daemonConfigDir();
 var CONFIG_PATH = daemonConfigPath();
 function readConfig() {
   try {
-    return JSON.parse(fs3.readFileSync(CONFIG_PATH, "utf-8"));
+    return JSON.parse(fs4.readFileSync(CONFIG_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeConfig(config) {
-  fs3.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
-  fs3.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 384 });
-  fs3.chmodSync(CONFIG_PATH, 384);
+  fs4.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  fs4.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 384 });
+  fs4.chmodSync(CONFIG_PATH, 384);
 }
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve3(answer.trim());
+      resolve4(answer.trim());
     });
   });
 }
@@ -2575,10 +3194,10 @@ function isLinux() {
 }
 var PLIST_LABEL = "com.parall.daemon";
 function plistPath() {
-  return path4.join(os2.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+  return path5.join(os2.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
 }
 function systemdUnitPath() {
-  return path4.join(os2.homedir(), ".config", "systemd", "user", "parall-daemon.service");
+  return path5.join(os2.homedir(), ".config", "systemd", "user", "parall-daemon.service");
 }
 function getDaemonBin() {
   try {
@@ -2588,7 +3207,7 @@ function getDaemonBin() {
   }
 }
 function generatePlist(daemonBin) {
-  const logPath = path4.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
+  const logPath = path5.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -2635,16 +3254,16 @@ function installService() {
   }
   const bin = getDaemonBin();
   if (isMacOS()) {
-    const dir = path4.dirname(plistPath());
-    fs3.mkdirSync(dir, { recursive: true });
-    fs3.writeFileSync(plistPath(), generatePlist(bin));
+    const dir = path5.dirname(plistPath());
+    fs4.mkdirSync(dir, { recursive: true });
+    fs4.writeFileSync(plistPath(), generatePlist(bin));
     execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`);
     execSync(`launchctl bootstrap gui/$(id -u) ${plistPath()}`);
     console.log(`launchd agent installed: ${plistPath()}`);
   } else if (isLinux()) {
-    const dir = path4.dirname(systemdUnitPath());
-    fs3.mkdirSync(dir, { recursive: true });
-    fs3.writeFileSync(systemdUnitPath(), generateSystemdUnit(bin));
+    const dir = path5.dirname(systemdUnitPath());
+    fs4.mkdirSync(dir, { recursive: true });
+    fs4.writeFileSync(systemdUnitPath(), generateSystemdUnit(bin));
     execSync("systemctl --user daemon-reload");
     execSync("systemctl --user enable --now parall-daemon");
     console.log(`systemd service installed: ${systemdUnitPath()}`);
@@ -2705,31 +3324,31 @@ function cmdStop() {
 }
 function cmdLogs(lines) {
   if (isLinux()) {
-    const child2 = spawn2("journalctl", ["--user-unit", "parall-daemon", "-n", lines, "-f"], {
+    const child2 = spawn3("journalctl", ["--user-unit", "parall-daemon", "-n", lines, "-f"], {
       stdio: "inherit"
     });
     child2.on("exit", (code) => process.exit(code ?? 0));
     return;
   }
-  const logPath = path4.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
-  if (!fs3.existsSync(logPath)) {
+  const logPath = path5.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
+  if (!fs4.existsSync(logPath)) {
     console.log("No log file found at", logPath);
     return;
   }
-  const child = spawn2("tail", ["-n", lines, "-f", logPath], { stdio: "inherit" });
+  const child = spawn3("tail", ["-n", lines, "-f", logPath], { stdio: "inherit" });
   child.on("exit", (code) => process.exit(code ?? 0));
 }
 function cmdServiceUninstall() {
   if (isMacOS()) {
     execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`);
-    if (fs3.existsSync(plistPath()))
-      fs3.unlinkSync(plistPath());
+    if (fs4.existsSync(plistPath()))
+      fs4.unlinkSync(plistPath());
     console.log("launchd agent uninstalled.");
   } else if (isLinux()) {
     execSync("systemctl --user stop parall-daemon 2>/dev/null || true");
     execSync("systemctl --user disable parall-daemon 2>/dev/null || true");
-    if (fs3.existsSync(systemdUnitPath()))
-      fs3.unlinkSync(systemdUnitPath());
+    if (fs4.existsSync(systemdUnitPath()))
+      fs4.unlinkSync(systemdUnitPath());
     execSync("systemctl --user daemon-reload");
     console.log("systemd service uninstalled.");
   } else {
@@ -2846,7 +3465,8 @@ async function main() {
   log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
   const client = new ParallClient({
     baseUrl: config.apiUrl,
-    token: config.apiKey
+    token: config.apiKey,
+    swimlaneName: config.swimlaneName
   });
   const abortController = new AbortController();
   const onSignal = (sig) => {
@@ -2863,7 +3483,7 @@ async function main() {
     process.exitCode = 1;
     process.exit(1);
   });
-  config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl);
+  config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
   await runForever(config, client, log, abortController.signal);
 }
 var cliArgs = process.argv.slice(2);