@parall/daemon 1.30.0 → 1.31.0

package/bundle/manifest.json

@@ -1,22 +1,23 @@
 {
-  "version": "1.30.0",
-  "built_at": "2026-05-21T12:46:24.454Z",
+  "version": "1.31.0",
+  "built_at": "2026-05-25T09:46:03.818Z",
   "files": {
     "parall-claude-agent.js": {
-      "sha256": "4e11b293fffa8cd05cbc3f06cf31e19024ec44d5830ba68e645bc0697b6c23c2",
-      "size": 233525
+      "sha256": "99e0829cda93f0ad208c9e017f0210203498a4be1c9077eb60f8e94ac24238db",
+      "size": 238575
     },
     "parall-codex-agent.js": {
-      "sha256": "65f489157cb660c029ae17fd882b052dfdd3e1273295ef5f1d6da4ede92cada5",
-      "size": 264796
+      "sha256": "809852713ed2d62fd65a1f050977c7ef44b0e568cd85fe66965ac671040db7b2",
+      "size": 269586
     },
     "parall-daemon.js": {
-      "sha256": "57a97577de50b9afc4af7f1bc786412b9b8b05bf0e9b3b9add4085733ccbb56d",
-      "size": 140056
+      "sha256": "d0de188d62e7e274f6eb52e50aca0926cd0e25d82031f56f24ef5c3e56e87786",
+      "size": 164213
     },
     "parall-openclaw-agent.js": {
-      "sha256": "d2128b5a15c37c9fe624ed6ba6f1dc15c32235d98795e6171716d9776014aedf",
-      "size": 8475
+      "sha256": "e876fa06665655a342b11de264896be7f64dc5d4635dee497f73f9984e95f651",
+      "size": 8457
     }
-  }
+  },
+  "signature": "rb+Dn/DCALZ7cTEWj+ta6bL2I9OcmFlyrUPoC299ey6FmZn2CgnDhdfq3uguwVnBRAvmTD1YjQJMFXm9wMe/AQ=="
 }

package/bundle/parall-claude-agent.js

@@ -3,6 +3,34 @@
 // ts/claude-agent/dist/index.js
 import * as os3 from "node:os";
 
+// ts/agent-core/dist/provider-config.js
+function llmSource(pc) {
+  if (pc?.llm_source)
+    return pc.llm_source;
+  if (pc?.openai_api_key || pc?.openai_base_url || pc?.anthropic_auth_token || pc?.anthropic_base_url) {
+    return "custom";
+  }
+  return "parall";
+}
+function clearAllProviderCreds(env) {
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.ANTHROPIC_BASE_URL;
+  delete env.ANTHROPIC_API_KEY;
+  delete env.OPENAI_API_KEY;
+  delete env.OPENAI_BASE_URL;
+  delete env.PRLL_CLAUDE_ALLOW_API_KEY;
+}
+function parseProviderConfig(env) {
+  const raw = env.PRLL_PROVIDER_CONFIG?.trim();
+  if (!raw)
+    return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid PRLL_PROVIDER_CONFIG JSON: ${String(err)}`);
+  }
+}
+
 // ts/agent-core/dist/session-state.js
 function normalizeSessionKey(sessionKey) {
   return sessionKey.toLowerCase();
@@ -474,6 +502,7 @@ var ENDPOINTS = {
   ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
   ORG_MEMBER_CHATS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/chats`,
   ORG_MEMBER_TASKS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/tasks`,
+  REF_SEARCH: (orgId) => `${API_BASE}/orgs/${orgId}/refs/search`,
   // Direct messages (org-scoped, atomic find-or-create + send)
   DM: (orgId) => `${API_BASE}/orgs/${orgId}/dm`,
   // Onboarding
@@ -556,6 +585,7 @@ var ENDPOINTS = {
   MACHINE_KEY: (orgId, machineId, keyId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/keys/${keyId}`,
   MACHINE_RUNTIME_AUTH_SESSIONS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth-sessions`,
   MACHINE_RUNTIME_AUTH_SESSION_COMPLETE: (orgId, machineId, sessionId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth-sessions/${sessionId}/complete`,
+  MACHINE_REQUEST_UPDATE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/request-update`,
   MACHINE_BROWSE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/browse`,
   // Machine self-control-plane (mck_-scoped). The bearer token implicitly
   // identifies the Machine, so there is no `:mid` URL parameter — these are
@@ -601,6 +631,12 @@ var ENDPOINTS = {
   INVITATION_ACCEPT: (id) => `${API_BASE}/invitations/${id}/accept`,
   INVITATION_DECLINE: (id) => `${API_BASE}/invitations/${id}/decline`,
   INVITATION_BY_TOKEN: (token) => `${API_BASE}/invitations/by-token/${token}`,
+  // Org-level shareable invite link
+  ORG_INVITE_LINK: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link`,
+  ORG_INVITE_LINK_REGENERATE: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link/regenerate`,
+  ORG_INVITE_LINK_JOIN_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link/join-requests`,
+  ORG_INVITE_LINK_JOIN_REQUEST_DECIDE: (orgId, jrId) => `${API_BASE}/orgs/${orgId}/invite-link/join-requests/${jrId}/decide`,
+  INVITE_LINK_JOIN: `${API_BASE}/invite-link/join`,
   // Wikis (org-scoped, served by wiki-service)
   WIKIS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis`,
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
@@ -720,6 +756,8 @@ var WS_EVENTS = {
   INVITATION_ACCEPTED: "invitation.accepted",
   INVITATION_DECLINED: "invitation.declined",
   INVITATION_REVOKED: "invitation.revoked",
+  ORG_JOIN_REQUEST_NEW: "org.join_request.new",
+  ORG_INVITE_LINK_JOINED: "org.invite_link.joined",
   AGENT_CONFIG_UPDATE: "agent_config.update",
   PRESENCE_UPDATE: "presence.update",
   WIKI_CHANGESET_CREATED: "wiki.changeset.created",
@@ -748,6 +786,8 @@ var WS_EVENTS = {
   MACHINE_STOP: "machine.stop",
   MACHINE_WORKSPACE_SETUP_REQUESTED: "machine.workspace.setup.requested",
   MACHINE_FILESYSTEM_BROWSE: "machine.filesystem.browse",
+  MACHINE_UPDATE: "machine.update",
+  MACHINE_CONFIG_UPDATED: "machine.config.updated",
   AGENT_NEW_SESSION: "agent.new_session"
 };
 
@@ -1077,6 +1117,9 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS_ONLINE(orgId));
     return res.user_ids ?? [];
   }
+  async searchRefs(orgId, params) {
+    return this.request("GET", ENDPOINTS.REF_SEARCH(orgId), void 0, params);
+  }
   async removeOrgMember(orgId, userId) {
     return this.request("DELETE", ENDPOINTS.ORG_MEMBER(orgId, userId));
   }
@@ -1130,6 +1173,34 @@ var ParallClient = class _ParallClient {
   async getInvitationByToken(token) {
     return this.request("GET", ENDPOINTS.INVITATION_BY_TOKEN(token));
   }
+  // ---- Org-level shareable invite link ----
+  /** Fetch the org's current invite link. Auto-creates on first call
+   *  so the settings UI never sees an empty state. */
+  async getOrgInviteLink(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_INVITE_LINK(orgId));
+  }
+  /** Rotate the token in place. The old token stops resolving immediately. */
+  async regenerateOrgInviteLink(orgId) {
+    return this.request("POST", ENDPOINTS.ORG_INVITE_LINK_REGENERATE(orgId));
+  }
+  /** Toggle the require-approval flag on the org's invite link. */
+  async updateOrgInviteLink(orgId, data) {
+    return this.request("PATCH", ENDPOINTS.ORG_INVITE_LINK(orgId), data);
+  }
+  /** Redeem an invite-link token. Caller must be authenticated; the
+   *  token is the lookup key so this endpoint is NOT org-scoped. */
+  async joinByInviteLink(token) {
+    return this.request("POST", ENDPOINTS.INVITE_LINK_JOIN, { token });
+  }
+  /** Admin: list pending invite-link join requests for an org. */
+  async listOrgJoinRequests(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_INVITE_LINK_JOIN_REQUESTS(orgId));
+    return res.data;
+  }
+  /** Admin: approve or reject a pending invite-link join request. */
+  async decideOrgJoinRequest(orgId, jrId, decision) {
+    return this.request("POST", ENDPOINTS.ORG_INVITE_LINK_JOIN_REQUEST_DECIDE(orgId, jrId), { decision });
+  }
   // ---- Direct Messages (org-scoped) ----
   async sendDirectMessage(orgId, req) {
     return this.request("POST", ENDPOINTS.DM(orgId), req);
@@ -1399,19 +1470,20 @@ var ParallClient = class _ParallClient {
   }
   // ---- Daemon-mode Machine management (org-scoped, user auth) ----
   /**
-   * Create a new daemon-mode Machine. Returns the Machine row + one-shot
-   * mck_ token. The UI uses this when the user clicks "Create Workspace".
+   * Create a new self-hosted daemon-mode Machine. Returns the Machine row +
+   * one-shot mck_ token.
    */
   async createMachine(orgId, opts) {
     return this.request("POST", ENDPOINTS.MACHINES(orgId), opts);
   }
   /**
-   * Returns only daemon_mode=true machines (non-terminated). Backs the
-   * "Workspaces" UI list. Legacy 1:1 machines are excluded.
+   * Returns local daemon_mode=true machines (non-terminated). Backs the
+   * "Workspaces" UI list. Legacy 1:1 and retired hosted daemon machines are
+   * excluded.
    */
   async getDaemonMachines(orgId) {
     const all = await this.getMachines(orgId);
-    return all.filter((m) => m.daemon_mode && m.status !== "terminated");
+    return all.filter((m) => m.daemon_mode && m.compute_mode === "local" && m.status !== "terminated");
   }
   /** Attach an agent to a daemon-mode Machine. */
   async attachAgent(orgId, machineId, agentId, opts) {
@@ -1431,8 +1503,8 @@ var ParallClient = class _ParallClient {
   async retryAgentWorkspaceSetup(orgId, machineId, agentId) {
     return this.request("POST", ENDPOINTS.MACHINE_AGENT_WORKSPACE_SETUP(orgId, machineId, agentId));
   }
-  async patchMachineLLMSource(orgId, machineId, llmSource) {
-    return this.request("PATCH", ENDPOINTS.MACHINE_LLM_SOURCE(orgId, machineId), { llm_source: llmSource });
+  async patchMachineLLMSource(orgId, machineId, llmSource2) {
+    return this.request("PATCH", ENDPOINTS.MACHINE_LLM_SOURCE(orgId, machineId), { llm_source: llmSource2 });
   }
   /** Get machine-level runtime auth state. */
   async getMachineRuntimeAuth(orgId, machineId) {
@@ -1473,8 +1545,9 @@ var ParallClient = class _ParallClient {
    * daemon should call this on a fixed cadence (e.g. every 30s) so an
    * external observer can detect a wedged supervisor.
    */
-  async postMachineHeartbeat() {
-    return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH);
+  async postMachineHeartbeat(daemonVersion) {
+    const body = daemonVersion ? { daemon_version: daemonVersion } : void 0;
+    return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH, body);
   }
   async reportAgentWorkspaceState(agentId, state) {
     const res = await this.request("PUT", ENDPOINTS.MACHINES_ME_AGENT_WORKSPACE_STATE(agentId), state);
@@ -1502,6 +1575,10 @@ var ParallClient = class _ParallClient {
   async resizeMachine(orgId, machineId, spec) {
     return this.request("PATCH", ENDPOINTS.MACHINE_SPEC(orgId, machineId), spec);
   }
+  /** Signal a local daemon-mode Machine to check for and apply an update. */
+  async requestMachineUpdate(orgId, machineId, mandatory = false) {
+    await this.request("POST", ENDPOINTS.MACHINE_REQUEST_UPDATE(orgId, machineId), { mandatory });
+  }
   async browseMachineFilesystem(orgId, machineId, path9) {
     return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path9 }, void 0, false, { timeoutMs: 15e3 });
   }
@@ -2352,6 +2429,7 @@ var ParallWs = class {
 };
 
 // ts/agent-core/dist/gateway-base.js
+var LIVE_SESSION_STATUSES = /* @__PURE__ */ new Set(["open", "active", "idle"]);
 function parseShutdownDeadlineMs(raw) {
   if (!raw)
     return void 0;
@@ -2821,6 +2899,17 @@ var ParallAgentGateway = class {
       parent_session_id: parentSessionId,
       runtime_ref: Object.keys(runtimeRef).length > 0 ? runtimeRef : void 0
     });
+    if (!LIVE_SESSION_STATUSES.has(session.status)) {
+      this.opts.log?.warn?.(`createAgentSession returned terminal session ${session.id} (${session.status}), resetting runtime for ${sessionKey}`);
+      this.sessionBindings.delete(sessionKey);
+      try {
+        await this.opts.onSessionStale?.(sessionKey);
+      } catch (e) {
+        this.opts.log?.warn?.(`onSessionStale failed: ${e}`);
+      }
+      this.opts.log?.info?.(`stale session self-heal complete for ${sessionKey} \u2014 next dispatch will create a fresh session`);
+      throw new Error(`Agent session ${session.id} is terminal (${session.status})`);
+    }
     const binding = {
       sessionKey,
       agentSessionId: session.id,
@@ -4284,8 +4373,8 @@ function resolveClaudeAgentConfig(env = process.env) {
   const apiKey = requireEnv(env, "PRLL_API_KEY");
   const orgId = requireEnv(env, "PRLL_ORG_ID");
   const claudeHome = resolvePath(env.PRLL_CLAUDE_HOME?.trim() || env.HOME || os2.homedir());
-  const stateDir = resolvePath(env.PRLL_CLAUDE_STATE_DIR?.trim() || path4.join(claudeHome, ".parall-agent"));
-  const workspaceDir = resolvePath(env.PRLL_CLAUDE_WORKSPACE_DIR?.trim() || path4.join(stateDir, "workspace"));
+  const stateDir = resolvePath(env.PRLL_STATE_DIR?.trim() || path4.join(claudeHome, ".parall-agent"));
+  const workspaceDir = resolvePath(env.PRLL_WORKSPACE_DIR?.trim() || path4.join(stateDir, "workspace"));
   const additionalDirs = parseList(env.PRLL_CLAUDE_ADD_DIRS).map(resolvePath);
   return {
     apiUrl,
@@ -5231,12 +5320,16 @@ var ClaudeCodeAdapter = class _ClaudeCodeAdapter {
     }
     this.opts.sessionManager.cleanupFork(fork.sessionKey);
   }
-  async shutdown() {
-    this.shuttingDown = true;
+  resetProcesses() {
     for (const [sessionKey, state] of this.processes) {
       this.killProcess(sessionKey, state);
     }
     this.processes.clear();
+    this.pendingInjections.clear();
+  }
+  async shutdown() {
+    this.shuttingDown = true;
+    this.resetProcesses();
     await this.opts.sessionManager.shutdownAll();
   }
   static STEER_TURN_TIMEOUT_MS = 1e4;
@@ -5728,7 +5821,27 @@ async function getAgentMeWithLegacyFallback(client, orgId) {
     return { ...user, agent_profile: null };
   }
 }
+function resolveProviderEnv() {
+  const pc = parseProviderConfig(process.env);
+  if (!pc)
+    return;
+  clearAllProviderCreds(process.env);
+  const source = llmSource(pc);
+  if (source === "parall") {
+    process.env.ANTHROPIC_AUTH_TOKEN = process.env.PRLL_API_KEY;
+    process.env.ANTHROPIC_BASE_URL = `${process.env.PRLL_API_URL}/api/llm`;
+    process.env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
+  } else if (source === "custom") {
+    if (pc.anthropic_auth_token) {
+      process.env.ANTHROPIC_AUTH_TOKEN = pc.anthropic_auth_token;
+      process.env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
+    }
+    if (pc.anthropic_base_url)
+      process.env.ANTHROPIC_BASE_URL = pc.anthropic_base_url;
+  }
+}
 async function main() {
+  resolveProviderEnv();
   const config = resolveClaudeAgentConfig(process.env);
   if (config.allowApiKey && (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN)) {
     log.warn("PRLL_CLAUDE_ALLOW_API_KEY=1 \u2014 ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN will reach the Claude CLI; billing routes through Anthropic API pay-per-use instead of Claude.ai OAuth.");
@@ -5839,7 +5952,11 @@ async function main() {
     onBeforeDisconnect: () => adapter.shutdown(),
     onNewSession: async () => {
       sessionManager.clearMainSession();
-      await adapter.shutdown();
+      adapter.resetProcesses();
+    },
+    onSessionStale: () => {
+      sessionManager.clearMainSession();
+      adapter.resetProcesses();
     }
   });
   const abortController = new AbortController();

package/bundle/parall-codex-agent.js

@@ -3,6 +3,34 @@
 // ts/codex-agent/dist/index.js
 import * as os3 from "node:os";
 
+// ts/agent-core/dist/provider-config.js
+function llmSource(pc) {
+  if (pc?.llm_source)
+    return pc.llm_source;
+  if (pc?.openai_api_key || pc?.openai_base_url || pc?.anthropic_auth_token || pc?.anthropic_base_url) {
+    return "custom";
+  }
+  return "parall";
+}
+function clearAllProviderCreds(env) {
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.ANTHROPIC_BASE_URL;
+  delete env.ANTHROPIC_API_KEY;
+  delete env.OPENAI_API_KEY;
+  delete env.OPENAI_BASE_URL;
+  delete env.PRLL_CLAUDE_ALLOW_API_KEY;
+}
+function parseProviderConfig(env) {
+  const raw = env.PRLL_PROVIDER_CONFIG?.trim();
+  if (!raw)
+    return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid PRLL_PROVIDER_CONFIG JSON: ${String(err)}`);
+  }
+}
+
 // ts/agent-core/dist/session-state.js
 function normalizeSessionKey(sessionKey) {
   return sessionKey.toLowerCase();
@@ -474,6 +502,7 @@ var ENDPOINTS = {
   ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
   ORG_MEMBER_CHATS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/chats`,
   ORG_MEMBER_TASKS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/tasks`,
+  REF_SEARCH: (orgId) => `${API_BASE}/orgs/${orgId}/refs/search`,
   // Direct messages (org-scoped, atomic find-or-create + send)
   DM: (orgId) => `${API_BASE}/orgs/${orgId}/dm`,
   // Onboarding
@@ -556,6 +585,7 @@ var ENDPOINTS = {
   MACHINE_KEY: (orgId, machineId, keyId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/keys/${keyId}`,
   MACHINE_RUNTIME_AUTH_SESSIONS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth-sessions`,
   MACHINE_RUNTIME_AUTH_SESSION_COMPLETE: (orgId, machineId, sessionId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth-sessions/${sessionId}/complete`,
+  MACHINE_REQUEST_UPDATE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/request-update`,
   MACHINE_BROWSE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/browse`,
   // Machine self-control-plane (mck_-scoped). The bearer token implicitly
   // identifies the Machine, so there is no `:mid` URL parameter — these are
@@ -601,6 +631,12 @@ var ENDPOINTS = {
   INVITATION_ACCEPT: (id) => `${API_BASE}/invitations/${id}/accept`,
   INVITATION_DECLINE: (id) => `${API_BASE}/invitations/${id}/decline`,
   INVITATION_BY_TOKEN: (token) => `${API_BASE}/invitations/by-token/${token}`,
+  // Org-level shareable invite link
+  ORG_INVITE_LINK: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link`,
+  ORG_INVITE_LINK_REGENERATE: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link/regenerate`,
+  ORG_INVITE_LINK_JOIN_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/invite-link/join-requests`,
+  ORG_INVITE_LINK_JOIN_REQUEST_DECIDE: (orgId, jrId) => `${API_BASE}/orgs/${orgId}/invite-link/join-requests/${jrId}/decide`,
+  INVITE_LINK_JOIN: `${API_BASE}/invite-link/join`,
   // Wikis (org-scoped, served by wiki-service)
   WIKIS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis`,
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
@@ -720,6 +756,8 @@ var WS_EVENTS = {
   INVITATION_ACCEPTED: "invitation.accepted",
   INVITATION_DECLINED: "invitation.declined",
   INVITATION_REVOKED: "invitation.revoked",
+  ORG_JOIN_REQUEST_NEW: "org.join_request.new",
+  ORG_INVITE_LINK_JOINED: "org.invite_link.joined",
   AGENT_CONFIG_UPDATE: "agent_config.update",
   PRESENCE_UPDATE: "presence.update",
   WIKI_CHANGESET_CREATED: "wiki.changeset.created",
@@ -748,6 +786,8 @@ var WS_EVENTS = {
   MACHINE_STOP: "machine.stop",
   MACHINE_WORKSPACE_SETUP_REQUESTED: "machine.workspace.setup.requested",
   MACHINE_FILESYSTEM_BROWSE: "machine.filesystem.browse",
+  MACHINE_UPDATE: "machine.update",
+  MACHINE_CONFIG_UPDATED: "machine.config.updated",
   AGENT_NEW_SESSION: "agent.new_session"
 };
 
@@ -1077,6 +1117,9 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS_ONLINE(orgId));
     return res.user_ids ?? [];
   }
+  async searchRefs(orgId, params) {
+    return this.request("GET", ENDPOINTS.REF_SEARCH(orgId), void 0, params);
+  }
   async removeOrgMember(orgId, userId) {
     return this.request("DELETE", ENDPOINTS.ORG_MEMBER(orgId, userId));
   }
@@ -1130,6 +1173,34 @@ var ParallClient = class _ParallClient {
   async getInvitationByToken(token) {
     return this.request("GET", ENDPOINTS.INVITATION_BY_TOKEN(token));
   }
+  // ---- Org-level shareable invite link ----
+  /** Fetch the org's current invite link. Auto-creates on first call
+   *  so the settings UI never sees an empty state. */
+  async getOrgInviteLink(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_INVITE_LINK(orgId));
+  }
+  /** Rotate the token in place. The old token stops resolving immediately. */
+  async regenerateOrgInviteLink(orgId) {
+    return this.request("POST", ENDPOINTS.ORG_INVITE_LINK_REGENERATE(orgId));
+  }
+  /** Toggle the require-approval flag on the org's invite link. */
+  async updateOrgInviteLink(orgId, data) {
+    return this.request("PATCH", ENDPOINTS.ORG_INVITE_LINK(orgId), data);
+  }
+  /** Redeem an invite-link token. Caller must be authenticated; the
+   *  token is the lookup key so this endpoint is NOT org-scoped. */
+  async joinByInviteLink(token) {
+    return this.request("POST", ENDPOINTS.INVITE_LINK_JOIN, { token });
+  }
+  /** Admin: list pending invite-link join requests for an org. */
+  async listOrgJoinRequests(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_INVITE_LINK_JOIN_REQUESTS(orgId));
+    return res.data;
+  }
+  /** Admin: approve or reject a pending invite-link join request. */
+  async decideOrgJoinRequest(orgId, jrId, decision) {
+    return this.request("POST", ENDPOINTS.ORG_INVITE_LINK_JOIN_REQUEST_DECIDE(orgId, jrId), { decision });
+  }
   // ---- Direct Messages (org-scoped) ----
   async sendDirectMessage(orgId, req) {
     return this.request("POST", ENDPOINTS.DM(orgId), req);
@@ -1399,19 +1470,20 @@ var ParallClient = class _ParallClient {
   }
   // ---- Daemon-mode Machine management (org-scoped, user auth) ----
   /**
-   * Create a new daemon-mode Machine. Returns the Machine row + one-shot
-   * mck_ token. The UI uses this when the user clicks "Create Workspace".
+   * Create a new self-hosted daemon-mode Machine. Returns the Machine row +
+   * one-shot mck_ token.
    */
   async createMachine(orgId, opts) {
     return this.request("POST", ENDPOINTS.MACHINES(orgId), opts);
   }
   /**
-   * Returns only daemon_mode=true machines (non-terminated). Backs the
-   * "Workspaces" UI list. Legacy 1:1 machines are excluded.
+   * Returns local daemon_mode=true machines (non-terminated). Backs the
+   * "Workspaces" UI list. Legacy 1:1 and retired hosted daemon machines are
+   * excluded.
    */
   async getDaemonMachines(orgId) {
     const all = await this.getMachines(orgId);
-    return all.filter((m) => m.daemon_mode && m.status !== "terminated");
+    return all.filter((m) => m.daemon_mode && m.compute_mode === "local" && m.status !== "terminated");
   }
   /** Attach an agent to a daemon-mode Machine. */
   async attachAgent(orgId, machineId, agentId, opts) {
@@ -1431,8 +1503,8 @@ var ParallClient = class _ParallClient {
   async retryAgentWorkspaceSetup(orgId, machineId, agentId) {
     return this.request("POST", ENDPOINTS.MACHINE_AGENT_WORKSPACE_SETUP(orgId, machineId, agentId));
   }
-  async patchMachineLLMSource(orgId, machineId, llmSource) {
-    return this.request("PATCH", ENDPOINTS.MACHINE_LLM_SOURCE(orgId, machineId), { llm_source: llmSource });
+  async patchMachineLLMSource(orgId, machineId, llmSource2) {
+    return this.request("PATCH", ENDPOINTS.MACHINE_LLM_SOURCE(orgId, machineId), { llm_source: llmSource2 });
   }
   /** Get machine-level runtime auth state. */
   async getMachineRuntimeAuth(orgId, machineId) {
@@ -1473,8 +1545,9 @@ var ParallClient = class _ParallClient {
    * daemon should call this on a fixed cadence (e.g. every 30s) so an
    * external observer can detect a wedged supervisor.
    */
-  async postMachineHeartbeat() {
-    return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH);
+  async postMachineHeartbeat(daemonVersion) {
+    const body = daemonVersion ? { daemon_version: daemonVersion } : void 0;
+    return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH, body);
   }
   async reportAgentWorkspaceState(agentId, state) {
     const res = await this.request("PUT", ENDPOINTS.MACHINES_ME_AGENT_WORKSPACE_STATE(agentId), state);
@@ -1502,6 +1575,10 @@ var ParallClient = class _ParallClient {
   async resizeMachine(orgId, machineId, spec) {
     return this.request("PATCH", ENDPOINTS.MACHINE_SPEC(orgId, machineId), spec);
   }
+  /** Signal a local daemon-mode Machine to check for and apply an update. */
+  async requestMachineUpdate(orgId, machineId, mandatory = false) {
+    await this.request("POST", ENDPOINTS.MACHINE_REQUEST_UPDATE(orgId, machineId), { mandatory });
+  }
   async browseMachineFilesystem(orgId, machineId, path8) {
     return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path8 }, void 0, false, { timeoutMs: 15e3 });
   }
@@ -2352,6 +2429,7 @@ var ParallWs = class {
 };
 
 // ts/agent-core/dist/gateway-base.js
+var LIVE_SESSION_STATUSES = /* @__PURE__ */ new Set(["open", "active", "idle"]);
 function parseShutdownDeadlineMs(raw) {
   if (!raw)
     return void 0;
@@ -2821,6 +2899,17 @@ var ParallAgentGateway = class {
       parent_session_id: parentSessionId,
       runtime_ref: Object.keys(runtimeRef).length > 0 ? runtimeRef : void 0
     });
+    if (!LIVE_SESSION_STATUSES.has(session.status)) {
+      this.opts.log?.warn?.(`createAgentSession returned terminal session ${session.id} (${session.status}), resetting runtime for ${sessionKey}`);
+      this.sessionBindings.delete(sessionKey);
+      try {
+        await this.opts.onSessionStale?.(sessionKey);
+      } catch (e) {
+        this.opts.log?.warn?.(`onSessionStale failed: ${e}`);
+      }
+      this.opts.log?.info?.(`stale session self-heal complete for ${sessionKey} \u2014 next dispatch will create a fresh session`);
+      throw new Error(`Agent session ${session.id} is terminal (${session.status})`);
+    }
     const binding = {
       sessionKey,
       agentSessionId: session.id,
@@ -4279,8 +4368,8 @@ function resolveCodexAgentConfig(env = process.env) {
   const apiKey = requireEnv(env, "PRLL_API_KEY");
   const orgId = requireEnv(env, "PRLL_ORG_ID");
   const codexHome = resolvePath(env.PRLL_CODEX_HOME?.trim() || env.CODEX_HOME?.trim() || path4.join(env.HOME || os2.homedir(), ".codex"));
-  const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim() || path4.join(env.HOME || os2.homedir(), ".parall-agent"));
-  const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path4.join(stateDir, "workspace"));
+  const stateDir = resolvePath(env.PRLL_STATE_DIR?.trim() || path4.join(env.HOME || os2.homedir(), ".parall-agent"));
+  const workspaceDir = resolvePath(env.PRLL_WORKSPACE_DIR?.trim() || path4.join(stateDir, "workspace"));
   return {
     apiUrl,
     apiKey,
@@ -6733,7 +6822,24 @@ async function getAgentMeWithLegacyFallback(client, orgId) {
     return { ...user, agent_profile: null };
   }
 }
+function resolveProviderEnv() {
+  const pc = parseProviderConfig(process.env);
+  if (!pc)
+    return;
+  clearAllProviderCreds(process.env);
+  const source = llmSource(pc);
+  if (source === "parall") {
+    process.env.OPENAI_API_KEY = process.env.PRLL_API_KEY;
+    process.env.OPENAI_BASE_URL = `${process.env.PRLL_API_URL}/api/llm/v1`;
+  } else if (source === "custom") {
+    if (pc.openai_api_key)
+      process.env.OPENAI_API_KEY = pc.openai_api_key;
+    if (pc.openai_base_url)
+      process.env.OPENAI_BASE_URL = pc.openai_base_url;
+  }
+}
 async function main() {
+  resolveProviderEnv();
   const config = resolveCodexAgentConfig(process.env);
   const client = new ParallClient({
     baseUrl: config.apiUrl,
@@ -6831,6 +6937,9 @@ async function main() {
     },
     onNewSession: () => {
       sessionManager.clearMainThread();
+    },
+    onSessionStale: () => {
+      sessionManager.clearMainThread();
     }
   });
   const abortController = new AbortController();