@parall/daemon 1.29.3 → 1.31.0

package/bundle/parall-openclaw-agent.js

@@ -23,7 +23,7 @@ function env(name) {
 var PRLL_API_URL = env("PRLL_API_URL");
 var PRLL_API_KEY = env("PRLL_API_KEY");
 var PRLL_ORG_ID = env("PRLL_ORG_ID");
-var stateDir = env("PRLL_OPENCLAW_STATE_DIR");
+var stateDir = env("PRLL_STATE_DIR");
 var PRLL_WS_URL = process.env.PRLL_WS_URL?.trim() || "";
 var PRLL_SWIMLANE_NAME = process.env.PRLL_SWIMLANE_NAME?.trim() || "";
 var gatewayPort = process.env.OPENCLAW_GATEWAY_PORT?.trim() || "0";
@@ -187,7 +187,7 @@ try {
 } catch {
 }
 log.info("Starting OpenClaw gateway...");
-var workspaceDir = process.env.PRLL_OPENCLAW_WORKSPACE_DIR?.trim() || "";
+var workspaceDir = process.env.PRLL_WORKSPACE_DIR?.trim() || "";
 var gatewayEnv = {
   ...process.env,
   OPENCLAW_STATE_DIR: openclawStateDir

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiPA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoD9E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiSA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAuD9E"}

package/dist/cli.js

@@ -51,6 +51,8 @@ function getDaemonBin() {
 }
 function generatePlist(daemonBin) {
     const logPath = path.join(os.homedir(), "Library", "Logs", "parall-daemon.log");
+    // Use a shell wrapper so the service manager loads the self-updated overlay
+    // bundle when it exists, falling back to the original npm-installed binary.
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -59,7 +61,9 @@ function generatePlist(daemonBin) {
     <string>${PLIST_LABEL}</string>
     <key>ProgramArguments</key>
     <array>
-        <string>${daemonBin}</string>
+        <string>/bin/sh</string>
+        <string>-c</string>
+        <string>OVERLAY="$HOME/.parall-daemon/bundle/current/parall-daemon.js"; if [ -f "$OVERLAY" ]; then exec node "$OVERLAY"; else exec ${daemonBin}; fi</string>
     </array>
     <key>RunAtLoad</key>
     <true/>
@@ -75,6 +79,8 @@ function generatePlist(daemonBin) {
 </plist>`;
 }
 function generateSystemdUnit(daemonBin) {
+    // Use a shell wrapper so the service manager loads the self-updated overlay
+    // bundle when it exists, falling back to the original npm-installed binary.
     return `[Unit]
 Description=Parall Daemon
 After=network-online.target
@@ -82,7 +88,7 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=${daemonBin}
+ExecStart=/bin/sh -c 'OVERLAY="$HOME/.parall-daemon/bundle/current/parall-daemon.js"; if [ -f "$OVERLAY" ]; then exec node "$OVERLAY"; else exec ${daemonBin}; fi'
 Restart=always
 RestartSec=5
 
@@ -206,6 +212,46 @@ function cmdServiceUninstall() {
         console.log("Unsupported platform.");
     }
 }
+async function cmdUpdate(checkOnly) {
+    const { resolveClaudeDaemonConfig, resolveBundleDir } = await import("./config.js");
+    const { DaemonUpdater } = await import("./updater.js");
+    const config = resolveClaudeDaemonConfig(process.env);
+    const bundleDir = resolveBundleDir(process.env);
+    const signingEnabled = !!process.env.PRLL_DAEMON_SIGNING_PUBLIC_KEY;
+    const updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, {
+        info: (msg) => console.log(msg),
+        warn: (msg) => console.warn(msg),
+        error: (msg) => console.error(msg),
+    }, signingEnabled);
+    const local = updater.getLocalVersion();
+    console.log(`Current version: ${local ?? "unknown"}`);
+    console.log(`CDN: ${config.updateCdnUrl}`);
+    console.log(`Bundle dir: ${bundleDir}`);
+    if (checkOnly) {
+        console.log("\nChecking for updates...");
+        const result = await updater.checkAvailable();
+        if (result.available) {
+            console.log(`Update available: ${result.currentVersion ?? "unknown"} → ${result.remoteVersion}`);
+        }
+        else if (result.remoteVersion) {
+            console.log(`Already up to date (${result.currentVersion}).`);
+        }
+        else {
+            console.log("Could not check for updates.");
+        }
+        return;
+    }
+    else {
+        console.log("\nChecking and applying updates...");
+    }
+    const applied = await updater.checkAndApply();
+    if (applied) {
+        console.log("Update applied. Restart the daemon to use the new version.");
+    }
+    else {
+        console.log("Already up to date.");
+    }
+}
 function printUsage() {
     console.log(`
 parall-daemon — Parall local agent runtime
@@ -215,6 +261,7 @@ Usage:
   parall-daemon init               Configure the daemon (interactive)
   parall-daemon status             Show daemon service status
   parall-daemon stop               Stop the background service
+  parall-daemon update [--check]   Check for / apply daemon updates
   parall-daemon logs [-n LINES]    Tail daemon logs
   parall-daemon service install    Install as background service (launchd/systemd)
   parall-daemon service uninstall  Uninstall background service
@@ -246,6 +293,9 @@ export async function runCLI(args) {
             cmdLogs(lines);
             return "handled";
         }
+        case "update":
+            await cmdUpdate(args.includes("--check"));
+            return "handled";
         case "service": {
             const sub = args[1];
             if (sub === "install") {

package/dist/config.d.ts

@@ -47,6 +47,12 @@ export type ClaudeDaemonConfig = {
      */
     supervisorRestartBackoffMs: number;
     supervisorRestartBackoffMaxMs: number;
+    /** CDN base URL for daemon bundle manifest (includes channel prefix). */
+    updateCdnUrl: string;
+    /** Update check interval in ms. Default 6h. Set 0 to disable periodic check. */
+    updateIntervalMs: number;
+    /** Disable self-update entirely (K8s env auto-disables). */
+    updateDisabled: boolean;
 };
 export declare function daemonConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function daemonConfigPath(env?: NodeJS.ProcessEnv): string;
@@ -63,5 +69,12 @@ export declare function sharedClaudeCredentialsFileFor(rootClaudeHome: string):
 export declare function agentClaudeCredentialsFileFor(agentClaudeHome: string): string;
 /** Per-agent workspace dir where the agent runs git commands. */
 export declare function agentWorkspaceDirFor(rootStateDir: string, agentId: string): string;
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export declare function resolveBundleDir(env?: NodeJS.ProcessEnv): string;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;CACvC,CAAC;AA2BF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CA6ClG;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AA2BF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAmDlG;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG"}

package/dist/config.js

@@ -91,6 +91,12 @@ export function resolveClaudeDaemonConfig(env = process.env) {
         bootstrapBackoffMaxMs: parseMs(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MAX_MS, 60_000),
         supervisorRestartBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS, 5_000),
         supervisorRestartBackoffMaxMs: parseMs(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MAX_MS, 5 * 60_000),
+        updateCdnUrl: env.PRLL_DAEMON_UPDATE_CDN_URL?.trim() ||
+            ((env.PRLL_DAEMON_UPDATE_CHANNEL?.trim() ?? "production") === "staging"
+                ? "https://releases.staging.prll.sh/daemon/staging"
+                : "https://releases.parall.com/daemon/production"),
+        updateIntervalMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_INTERVAL_MS, 6 * 60 * 60_000),
+        updateDisabled: env.PRLL_DAEMON_UPDATE_DISABLED === "true" || !!env.KUBERNETES_SERVICE_HOST,
     };
 }
 function assertSafeAgentId(agentId) {
@@ -121,6 +127,17 @@ export function agentClaudeCredentialsFileFor(agentClaudeHome) {
 export function agentWorkspaceDirFor(rootStateDir, agentId) {
     return path.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
 }
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export function resolveBundleDir(env = process.env) {
+    if (env.PRLL_DAEMON_BUNDLE_DIR)
+        return resolvePath(env.PRLL_DAEMON_BUNDLE_DIR);
+    return path.join(daemonConfigDir(env), "bundle");
+}
 export function resolveWsUrl(apiUrl, explicitWsUrl, swimlaneName) {
     const base = explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
     if (!swimlaneName)

package/dist/filesystem.d.ts

@@ -0,0 +1,7 @@
+import type { FilesystemEntry } from "@parall/sdk";
+export declare function browseDenyReason(value: string): string;
+export declare function listDirectory(dirPath: string): Promise<{
+    entries: FilesystemEntry[];
+    error?: string;
+}>;
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../src/filesystem.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAqCnD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBtD;AAoBD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8C5G"}

package/dist/filesystem.js

@@ -0,0 +1,118 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+const MAX_ENTRIES = 200;
+const SYSTEM_DIR_PREFIXES = [
+    "/Applications",
+    "/bin",
+    "/boot",
+    "/dev",
+    "/etc",
+    "/Library",
+    "/private",
+    "/proc",
+    "/root",
+    "/run",
+    "/sbin",
+    "/System",
+    "/sys",
+    "/usr",
+    "/var",
+];
+const CREDENTIAL_DIR_NAMES = new Set([
+    ".aws",
+    ".azure",
+    ".claude",
+    ".codex",
+    ".config",
+    ".docker",
+    ".gnupg",
+    ".kube",
+    ".npm",
+    ".ssh",
+    ".parall-agent",
+    ".parall-daemon",
+]);
+export function browseDenyReason(value) {
+    const normalized = path.resolve(value).split(path.sep).join("/");
+    if (normalized === "/")
+        return "";
+    for (const prefix of SYSTEM_DIR_PREFIXES) {
+        if (normalized === prefix || normalized.startsWith(`${prefix}/`)) {
+            return "a system directory";
+        }
+    }
+    const parts = normalized.split("/").filter(Boolean);
+    for (const part of parts) {
+        if (CREDENTIAL_DIR_NAMES.has(part)) {
+            return "a credential or application state directory";
+        }
+    }
+    return "";
+}
+function syntheticRoots() {
+    const roots = [];
+    const platform = os.platform();
+    const candidates = platform === "darwin"
+        ? ["/Users", os.homedir()]
+        : ["/home", os.homedir()];
+    for (const dir of [...new Set(candidates)]) {
+        try {
+            fs.accessSync(dir, fs.constants.R_OK);
+            roots.push({ name: dir, type: "dir" });
+        }
+        catch {
+            // not accessible
+        }
+    }
+    return roots;
+}
+export async function listDirectory(dirPath) {
+    const resolved = path.resolve(dirPath);
+    const normalized = resolved.split(path.sep).join("/");
+    if (normalized === "/") {
+        return { entries: syntheticRoots() };
+    }
+    const deny = browseDenyReason(normalized);
+    if (deny) {
+        return { entries: [], error: `Access denied: ${deny}` };
+    }
+    let realPath;
+    try {
+        realPath = fs.realpathSync(resolved);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return { entries: [], error: "Directory not found" };
+        return { entries: [], error: "Permission denied" };
+    }
+    const realDeny = browseDenyReason(realPath.split(path.sep).join("/"));
+    if (realDeny) {
+        return { entries: [], error: `Access denied: ${realDeny}` };
+    }
+    let dirents;
+    try {
+        dirents = fs.readdirSync(realPath, { withFileTypes: true });
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return { entries: [], error: "Directory not found" };
+        if (code === "EACCES" || code === "EPERM")
+            return { entries: [], error: "Permission denied" };
+        return { entries: [], error: `Failed to read directory: ${code ?? String(err)}` };
+    }
+    const entries = [];
+    for (const d of dirents) {
+        if (!d.isDirectory())
+            continue;
+        if (d.name.startsWith("."))
+            continue;
+        entries.push({ name: d.name, type: "dir" });
+        if (entries.length >= MAX_ENTRIES)
+            break;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    return { entries };
+}

package/dist/index.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import { createLogger } from "@parall/agent-core";
 import { ParallClient } from "@parall/sdk";
-import { resolveClaudeDaemonConfig, resolveWsUrl } from "./config.js";
+import { resolveClaudeDaemonConfig, resolveBundleDir, resolveWsUrl } from "./config.js";
 import { DaemonSupervisor, sleepCancellable } from "./supervisor.js";
+import { DaemonUpdater } from "./updater.js";
 import { runCLI } from "./cli.js";
+const UPDATE_EXIT_CODE = 42;
 const log = createLogger("daemon");
 function formatError(reason) {
     if (reason instanceof Error) {
@@ -30,10 +32,12 @@ function formatError(reason) {
  * any supervisor.run() rejection and rely entirely on the shell wrapper +
  * K8s for restart.
  */
-async function runForever(config, client, log, signal) {
+async function runForever(config, client, log, signal, updater) {
     let attempt = 0;
     while (!signal.aborted) {
         const supervisor = new DaemonSupervisor(config, client, log);
+        if (updater)
+            supervisor.setUpdater(updater);
         try {
             await supervisor.run(signal);
             // Clean exit (signal aborted) — done.
@@ -70,6 +74,17 @@ async function main() {
     const config = resolveClaudeDaemonConfig(process.env);
     log.info(`boot: api=${config.apiUrl} pollMs=${config.pollIntervalMs} heartbeatMs=${config.heartbeatIntervalMs} agentBin=${config.agentBin}`);
     log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
+    // --- Self-update: rollback check (before any network calls) ---
+    let updater = null;
+    if (!config.updateDisabled) {
+        const bundleDir = resolveBundleDir(process.env);
+        updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, log, true);
+        if (updater.checkRollback()) {
+            log.info("rollback applied — exiting for service manager restart");
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        log.info(`update: bundleDir=${bundleDir} cdn=${config.updateCdnUrl} interval=${config.updateIntervalMs}ms`);
+    }
     // The daemon talks to the API as a Machine — the bearer is mck_*.
     // No orgId is configured here; per-agent subprocesses get their
     // own org_id via the spawn env.
@@ -97,7 +112,19 @@ async function main() {
         process.exit(1);
     });
     config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
-    await runForever(config, client, log, abortController.signal);
+    // --- Self-update: boot check + periodic timer ---
+    if (updater) {
+        const applied = await updater.checkAndApply().catch((err) => {
+            log.warn(`boot update check failed: ${String(err)}`);
+            return false;
+        });
+        if (applied) {
+            log.info("boot update applied — exiting for restart");
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        updater.startPeriodicCheck(config.updateIntervalMs);
+    }
+    await runForever(config, client, log, abortController.signal, updater);
 }
 const cliArgs = process.argv.slice(2);
 runCLI(cliArgs)

package/dist/runtimes.d.ts

@@ -1,10 +1,7 @@
-export interface ProviderConfig {
-    llm_source?: string;
-    openai_api_key?: string;
-    openai_base_url?: string;
-    anthropic_auth_token?: string;
-    anthropic_base_url?: string;
-}
+import { clearAllProviderCreds } from "@parall/agent-core";
+import type { ProviderConfig } from "@parall/agent-core";
+export type { ProviderConfig };
+export { clearAllProviderCreds };
 export interface RuntimeAdapter {
     bin: string;
     buildEnv(baseEnv: NodeJS.ProcessEnv, agentId: string, orgId: string, apiKey: string, dirs: AgentDirs, pc?: ProviderConfig): NodeJS.ProcessEnv;
@@ -14,7 +11,11 @@ export interface AgentDirs {
     workspaceDir: string;
     claudeHome: string;
 }
-export declare function clearAllProviderCreds(env: NodeJS.ProcessEnv): void;
+/**
+ * Resolve a runtime adapter, preferring overlay bundle paths when available.
+ * When the daemon has self-updated into ~/.parall-daemon/bundle/, bridge
+ * binaries should also load from overlay to keep versions in sync.
+ */
 export declare function getRuntimeAdapter(runtimeType: string): RuntimeAdapter;
 export declare function assertAgentKey(apiKey: string): void;
 //# sourceMappingURL=runtimes.d.ts.map

package/dist/runtimes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;CAC/I;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAOlE;AAgGD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAErE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}
+{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;CAC/I;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AA4DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAerE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}

package/dist/runtimes.js

@@ -1,107 +1,47 @@
+import * as fs from "node:fs";
 import * as path from "node:path";
-function llmSource(pc) {
-    if (pc?.llm_source)
-        return pc.llm_source;
-    if (pc?.openai_api_key ||
-        pc?.openai_base_url ||
-        pc?.anthropic_auth_token ||
-        pc?.anthropic_base_url) {
-        return "custom";
-    }
-    return "parall";
-}
-export function clearAllProviderCreds(env) {
-    delete env.ANTHROPIC_AUTH_TOKEN;
-    delete env.ANTHROPIC_BASE_URL;
-    delete env.ANTHROPIC_API_KEY;
-    delete env.OPENAI_API_KEY;
-    delete env.OPENAI_BASE_URL;
-    delete env.PRLL_CLAUDE_ALLOW_API_KEY;
+import { clearAllProviderCreds } from "@parall/agent-core";
+import { resolveBundleDir } from "./config.js";
+export { clearAllProviderCreds };
+function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
+    const env = { ...baseEnv };
+    clearAllProviderCreds(env);
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_STATE_DIR = dirs.stateDir;
+    env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
+    if (pc)
+        env.PRLL_PROVIDER_CONFIG = JSON.stringify(pc);
+    delete env.PRLL_DAEMON_MODE;
+    return env;
 }
 const claudeCodeAdapter = {
     bin: "parall-claude-agent",
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.PRLL_CLAUDE_HOME = dirs.claudeHome;
-        env.PRLL_CLAUDE_STATE_DIR = dirs.stateDir;
-        env.PRLL_CLAUDE_WORKSPACE_DIR = dirs.workspaceDir;
-        const source = llmSource(pc);
-        if (source === "parall") {
-            env.ANTHROPIC_AUTH_TOKEN = apiKey;
-            env.ANTHROPIC_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm`;
-            env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
-        }
-        else if (source === "custom") {
-            if (pc?.anthropic_auth_token) {
-                env.ANTHROPIC_AUTH_TOKEN = pc.anthropic_auth_token;
-                env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
-            }
-            if (pc?.anthropic_base_url)
-                env.ANTHROPIC_BASE_URL = pc.anthropic_base_url;
-        }
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
 const codexAdapter = {
     bin: "parall-codex-agent",
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_CODEX_STATE_DIR = dirs.stateDir;
-        env.PRLL_CODEX_WORKSPACE_DIR = dirs.workspaceDir;
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.PRLL_CODEX_HOME = path.join(dirs.stateDir, ".codex");
-        const source = llmSource(pc);
-        if (source === "parall") {
-            env.OPENAI_API_KEY = apiKey;
-            env.OPENAI_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm/v1`;
-        }
-        else if (source === "custom") {
-            if (pc?.openai_api_key)
-                env.OPENAI_API_KEY = pc.openai_api_key;
-            if (pc?.openai_base_url)
-                env.OPENAI_BASE_URL = pc.openai_base_url;
-        }
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
 const defaultAdapter = {
     bin: "parall-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
-        const env = { ...baseEnv };
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_STATE_DIR = dirs.stateDir;
-        env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
-        delete env.PRLL_DAEMON_MODE;
-        return env;
-    },
+    buildEnv: buildStandardEnv,
 };
 const openclawAdapter = {
     bin: "parall-openclaw-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_OPENCLAW_STATE_DIR = dirs.stateDir;
-        env.PRLL_OPENCLAW_WORKSPACE_DIR = dirs.workspaceDir;
+    buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.OPENCLAW_GATEWAY_PORT = env.OPENCLAW_GATEWAY_PORT || "0";
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
@@ -110,8 +50,32 @@ const RUNTIME_ADAPTERS = {
     "codex": codexAdapter,
     "openclaw": openclawAdapter,
 };
+const OVERLAY_BIN_NAMES = {
+    "claude-code": "parall-claude-agent.js",
+    "codex": "parall-codex-agent.js",
+    "openclaw": "parall-openclaw-agent.js",
+};
+/**
+ * Resolve a runtime adapter, preferring overlay bundle paths when available.
+ * When the daemon has self-updated into ~/.parall-daemon/bundle/, bridge
+ * binaries should also load from overlay to keep versions in sync.
+ */
 export function getRuntimeAdapter(runtimeType) {
-    return RUNTIME_ADAPTERS[runtimeType] ?? defaultAdapter;
+    const base = RUNTIME_ADAPTERS[runtimeType] ?? defaultAdapter;
+    const overlayName = OVERLAY_BIN_NAMES[runtimeType];
+    if (!overlayName)
+        return base;
+    try {
+        const bundleDir = resolveBundleDir();
+        const overlayBin = path.join(bundleDir, "current", overlayName);
+        if (fs.existsSync(overlayBin)) {
+            return { ...base, bin: overlayBin };
+        }
+    }
+    catch {
+        // resolveBundleDir may fail in unusual setups; fall through
+    }
+    return base;
 }
 export function assertAgentKey(apiKey) {
     if (apiKey.startsWith("mck_")) {

package/dist/supervisor.d.ts

@@ -1,5 +1,6 @@
 import type { GatewayLogger } from "@parall/agent-core";
 import { ParallClient } from "@parall/sdk";
+import type { DaemonUpdater } from "./updater.js";
 import { type ClaudeDaemonConfig } from "./config.js";
 /**
  * Sleep that wakes early on abort. Returns true if the full delay elapsed,
@@ -33,7 +34,10 @@ export declare class DaemonSupervisor {
     private machineOrgId;
     private machineLlmSource;
     private stopResolve;
+    private updater;
+    private healthConfirmed;
     constructor(config: ClaudeDaemonConfig, client: ParallClient, log: GatewayLogger);
+    setUpdater(updater: DaemonUpdater): void;
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     run(signal: AbortSignal): Promise<void>;
     /** Disconnect WS, cancel timers, SIGTERM all children, await exit. */
@@ -49,6 +53,7 @@ export declare class DaemonSupervisor {
     private fetchAttachedAgent;
     private handleAgentAttached;
     private handleAgentDetached;
+    private handleFilesystemBrowse;
     private handleWorkspaceSetupRequested;
     private scheduleWorkspaceSetupRetry;
     private clearWorkspaceSetupRetry;

package/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAA2N,MAAM,aAAa,CAAC;AACpQ,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAiBrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAazB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAdtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;gBAG7B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiF7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAiCb,kBAAkB;YAqClB,aAAa;IAqD3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;YAcpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IA2D5B,OAAO,CAAC,UAAU;YA0EJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAqR,MAAM,aAAa,CAAC;AAC9T,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAiBrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAezB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAhBtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,eAAe,CAAS;gBAGb,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsH7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAiCb,kBAAkB;YAqClB,aAAa;IAqD3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,sBAAsB;YAwBtB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;YAcpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IA2D5B,OAAO,CAAC,UAAU;YA0EJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}