@parall/daemon 1.29.3 → 1.31.0

package/dist/supervisor.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { ParallWs } from "@parall/sdk";
+import { listDirectory } from "./filesystem.js";
 import { agentClaudeCredentialsFileFor, agentClaudeHomeFor, agentStateDirFor, agentWorkspaceDirFor, sharedClaudeCredentialsFileFor, } from "./config.js";
 import { assertAgentKey, getRuntimeAdapter } from "./runtimes.js";
 import { prepareWorkspace } from "./workspace.js";
@@ -57,11 +58,16 @@ export class DaemonSupervisor {
     machineOrgId = null;
     machineLlmSource = "parall";
     stopResolve = null;
+    updater = null;
+    healthConfirmed = false;
     constructor(config, client, log) {
         this.config = config;
         this.client = client;
         this.log = log;
     }
+    setUpdater(updater) {
+        this.updater = updater;
+    }
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     async run(signal) {
         if (this.running)
@@ -84,6 +90,11 @@ export class DaemonSupervisor {
             throw err;
         }
         this.migrateFlatLayout();
+        // Report daemon version via heartbeat (best-effort)
+        const daemonVersion = this.updater?.getLocalVersion();
+        if (daemonVersion) {
+            this.client.postMachineHeartbeat(daemonVersion).catch((err) => this.log.warn(`daemon version report failed: ${String(err)}`));
+        }
         await this.fullReconcile();
         this.ws = new ParallWs({
             getTicket: () => this.client.getMachineWsTicket(),
@@ -92,11 +103,34 @@ export class DaemonSupervisor {
         });
         this.ws.on("machine.hello", (_data) => {
             this.log.info("machine WS connected (machine.hello)");
+            if (!this.healthConfirmed && this.updater) {
+                try {
+                    this.updater.confirmVersion();
+                    this.healthConfirmed = true;
+                }
+                catch (err) {
+                    this.log.warn(`confirmVersion failed: ${String(err)}`);
+                }
+            }
             void (async () => {
                 await this.refreshMachineConfig();
                 await this.fullReconcile();
             })();
         });
+        this.ws.on("machine.update", (data) => {
+            this.log.info(`WS: daemon update available — version=${data.new_version} mandatory=${data.mandatory}`);
+            if (this.updater) {
+                void this.updater.triggerUpdate(data.new_version, data.mandatory).then(async (applied) => {
+                    if (applied) {
+                        this.log.info("daemon update applied — stopping supervisor before restart");
+                        await this.stop();
+                        process.exit(42);
+                    }
+                }).catch((err) => {
+                    this.log.warn(`daemon update failed: ${String(err)}`);
+                });
+            }
+        });
         this.ws.on("machine.agent.attached", (data) => {
             this.log.info(`WS: agent ${data.agent_id} attached`);
             void this.handleAgentAttached(data.agent_id);
@@ -117,6 +151,10 @@ export class DaemonSupervisor {
             this.log.info(`WS: workspace setup requested for agent ${data.agent_id}`);
             void this.handleWorkspaceSetupRequested(data.agent_id);
         });
+        this.ws.on("machine.filesystem.browse", (data) => {
+            this.log.info(`WS: filesystem browse requested: ${data.path}`);
+            void this.handleFilesystemBrowse(data.request_id, data.path);
+        });
         this.ws.on("machine.stop", (data) => {
             this.log.info(`WS: machine.stop received (reason=${data.reason ?? "none"})`);
             void this.stop();
@@ -343,6 +381,31 @@ export class DaemonSupervisor {
         await this.terminateChild(state);
         this.children.delete(agentId);
     }
+    async handleFilesystemBrowse(requestId, dirPath) {
+        try {
+            const result = await listDirectory(dirPath);
+            await this.client.postBrowseResponse(requestId, {
+                request_id: requestId,
+                path: dirPath,
+                entries: result.entries,
+                error: result.error,
+            });
+        }
+        catch (err) {
+            this.log.warn(`filesystem browse failed: ${String(err)}`);
+            try {
+                await this.client.postBrowseResponse(requestId, {
+                    request_id: requestId,
+                    path: dirPath,
+                    entries: [],
+                    error: String(err),
+                });
+            }
+            catch {
+                // best-effort
+            }
+        }
+    }
     async handleWorkspaceSetupRequested(agentId) {
         if (this.spawningAgents.has(agentId)) {
             this.log.info(`agent ${agentId}: workspace setup already in progress; queueing one restart`);

package/dist/updater-manifest.d.ts

@@ -0,0 +1,39 @@
+export interface ManifestFile {
+    sha256: string;
+    size: number;
+}
+export interface RemoteManifest {
+    version: string;
+    built_at: string;
+    min_daemon_version?: string;
+    files: Record<string, ManifestFile>;
+    signature: string;
+}
+export interface LocalManifest {
+    version: string;
+    built_at: string;
+    files: Record<string, ManifestFile>;
+}
+/**
+ * Recursively sort all object keys at every depth for deterministic JSON output.
+ * Arrays preserve order; primitives pass through.
+ */
+export declare function canonicalize(obj: unknown): unknown;
+/**
+ * Verify the Ed25519 signature of a remote manifest.
+ * Signs canonical JSON of all fields except `signature`.
+ */
+export declare function verifyManifestSignature(manifest: RemoteManifest, publicKey: string): boolean;
+/**
+ * Compare two semver strings (including prerelease tags). Returns:
+ *   -1 if a < b
+ *    0 if a == b
+ *    1 if a > b
+ *   null if either is not valid semver
+ *
+ * Prerelease ordering follows SemVer 2.0: a version with prerelease has
+ * lower precedence than the same version without prerelease. Prerelease
+ * identifiers are compared lexicographically when both present.
+ */
+export declare function semverCompare(a: string, b: string): number | null;
+//# sourceMappingURL=updater-manifest.d.ts.map

package/dist/updater-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater-manifest.d.ts","sourceRoot":"","sources":["../src/updater-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}

package/dist/updater-manifest.js

@@ -0,0 +1,94 @@
+import { verify } from "node:crypto";
+/**
+ * Recursively sort all object keys at every depth for deterministic JSON output.
+ * Arrays preserve order; primitives pass through.
+ */
+export function canonicalize(obj) {
+    if (Array.isArray(obj))
+        return obj.map(canonicalize);
+    if (obj !== null && typeof obj === "object") {
+        const sorted = {};
+        for (const k of Object.keys(obj).sort()) {
+            sorted[k] = canonicalize(obj[k]);
+        }
+        return sorted;
+    }
+    return obj;
+}
+/**
+ * Verify the Ed25519 signature of a remote manifest.
+ * Signs canonical JSON of all fields except `signature`.
+ */
+export function verifyManifestSignature(manifest, publicKey) {
+    const { signature, ...rest } = manifest;
+    const canonical = JSON.stringify(canonicalize(rest));
+    try {
+        return verify(null, Buffer.from(canonical), publicKey, Buffer.from(signature, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Compare two semver strings (including prerelease tags). Returns:
+ *   -1 if a < b
+ *    0 if a == b
+ *    1 if a > b
+ *   null if either is not valid semver
+ *
+ * Prerelease ordering follows SemVer 2.0: a version with prerelease has
+ * lower precedence than the same version without prerelease. Prerelease
+ * identifiers are compared lexicographically when both present.
+ */
+export function semverCompare(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        if (pa.nums[i] < pb.nums[i])
+            return -1;
+        if (pa.nums[i] > pb.nums[i])
+            return 1;
+    }
+    // Same major.minor.patch — compare prerelease:
+    // no prerelease > has prerelease (per SemVer §11)
+    if (!pa.pre && !pb.pre)
+        return 0;
+    if (!pa.pre)
+        return 1;
+    if (!pb.pre)
+        return -1;
+    // Both have prerelease: lexicographic comparison
+    if (pa.pre < pb.pre)
+        return -1;
+    if (pa.pre > pb.pre)
+        return 1;
+    return 0;
+}
+function parseSemver(v) {
+    // Split off prerelease at the first hyphen in the patch component.
+    // e.g. "0.0.0-staging.abc1234" → major=0, minor=0, patch="0", pre="staging.abc1234"
+    const parts = v.split(".");
+    if (parts.length < 3)
+        return null;
+    // Rejoin any dots beyond the first two (prerelease may contain dots)
+    const major = Number(parts[0]);
+    const minor = Number(parts[1]);
+    const rest = parts.slice(2).join(".");
+    // Split patch from prerelease: "0-staging.abc" → patch="0", pre="staging.abc"
+    const hyphen = rest.indexOf("-");
+    let patchStr;
+    let pre;
+    if (hyphen >= 0) {
+        patchStr = rest.slice(0, hyphen);
+        pre = rest.slice(hyphen + 1);
+    }
+    else {
+        patchStr = rest;
+    }
+    const patch = Number(patchStr);
+    if (isNaN(major) || isNaN(minor) || isNaN(patch))
+        return null;
+    return { nums: [major, minor, patch], pre };
+}

package/dist/updater.d.ts

@@ -0,0 +1,60 @@
+import type { GatewayLogger } from "@parall/agent-core";
+import { type LocalManifest } from "./updater-manifest.js";
+export declare class DaemonUpdater {
+    private readonly bundleDir;
+    private readonly cdnBaseUrl;
+    private readonly log;
+    private readonly signingEnabled;
+    private updating;
+    private periodicTimer;
+    constructor(bundleDir: string, cdnBaseUrl: string, log: GatewayLogger, signingEnabled: boolean);
+    /**
+     * Start periodic update checks. Call once after supervisor bootstrap.
+     */
+    startPeriodicCheck(intervalMs: number): void;
+    stopPeriodicCheck(): void;
+    /**
+     * Check CDN for a newer version. Returns true if update was applied
+     * (caller should exit for service manager restart).
+     */
+    checkAndApply(targetVersion?: string): Promise<boolean>;
+    /**
+     * Handle WS-triggered update. Adds jitter for non-mandatory updates.
+     */
+    triggerUpdate(targetVersion: string, mandatory: boolean): Promise<boolean>;
+    /**
+     * Check if we need to roll back from a failed update.
+     * Call on every daemon startup, before bootstrap.
+     * Returns true if rollback was performed (caller should exit immediately).
+     */
+    checkRollback(): boolean;
+    /**
+     * Confirm the current version after successful health check.
+     * Clears pending state so rollback won't trigger.
+     */
+    confirmVersion(): void;
+    /**
+     * Get the current local manifest version (for heartbeat reporting).
+     */
+    getLocalVersion(): string | undefined;
+    /**
+     * Check CDN for available update without downloading.
+     * Returns remote version info for CLI --check display.
+     */
+    checkAvailable(): Promise<{
+        available: boolean;
+        currentVersion?: string;
+        remoteVersion?: string;
+    }>;
+    private doUpdate;
+    private atomicSwap;
+    private swapSymlink;
+    private pruneOldVersions;
+    loadLocalManifest(): LocalManifest | null;
+    private loadUpdateState;
+    private saveUpdateState;
+    private httpGet;
+    private downloadFile;
+    private cleanDir;
+}
+//# sourceMappingURL=updater.d.ts.map

package/dist/updater.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../src/updater.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,uBAAuB,CAAC;AAoB/B,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAA+B;gBAGjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,EAClB,cAAc,EAAE,OAAO;IAK1C;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C,iBAAiB,IAAI,IAAI;IAOzB;;;OAGG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D;;OAEG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF;;;;OAIG;IACH,aAAa,IAAI,OAAO;IA6CxB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAYtB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAmB1F,QAAQ;IAqGtB,OAAO,CAAC,UAAU;IAmClB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,gBAAgB;IAmBxB,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAUzC,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,OAAO;IA8Bf,OAAO,CAAC,YAAY;IAoCpB,OAAO,CAAC,QAAQ;CAKjB"}