@parall/daemon 1.30.0 → 1.31.0

package/bundle/parall-openclaw-agent.js

@@ -23,7 +23,7 @@ function env(name) {
 var PRLL_API_URL = env("PRLL_API_URL");
 var PRLL_API_KEY = env("PRLL_API_KEY");
 var PRLL_ORG_ID = env("PRLL_ORG_ID");
-var stateDir = env("PRLL_OPENCLAW_STATE_DIR");
+var stateDir = env("PRLL_STATE_DIR");
 var PRLL_WS_URL = process.env.PRLL_WS_URL?.trim() || "";
 var PRLL_SWIMLANE_NAME = process.env.PRLL_SWIMLANE_NAME?.trim() || "";
 var gatewayPort = process.env.OPENCLAW_GATEWAY_PORT?.trim() || "0";
@@ -187,7 +187,7 @@ try {
 } catch {
 }
 log.info("Starting OpenClaw gateway...");
-var workspaceDir = process.env.PRLL_OPENCLAW_WORKSPACE_DIR?.trim() || "";
+var workspaceDir = process.env.PRLL_WORKSPACE_DIR?.trim() || "";
 var gatewayEnv = {
   ...process.env,
   OPENCLAW_STATE_DIR: openclawStateDir

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiPA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoD9E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiSA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAuD9E"}

package/dist/cli.js

@@ -51,6 +51,8 @@ function getDaemonBin() {
 }
 function generatePlist(daemonBin) {
     const logPath = path.join(os.homedir(), "Library", "Logs", "parall-daemon.log");
+    // Use a shell wrapper so the service manager loads the self-updated overlay
+    // bundle when it exists, falling back to the original npm-installed binary.
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -59,7 +61,9 @@ function generatePlist(daemonBin) {
     <string>${PLIST_LABEL}</string>
     <key>ProgramArguments</key>
     <array>
-        <string>${daemonBin}</string>
+        <string>/bin/sh</string>
+        <string>-c</string>
+        <string>OVERLAY="$HOME/.parall-daemon/bundle/current/parall-daemon.js"; if [ -f "$OVERLAY" ]; then exec node "$OVERLAY"; else exec ${daemonBin}; fi</string>
     </array>
     <key>RunAtLoad</key>
     <true/>
@@ -75,6 +79,8 @@ function generatePlist(daemonBin) {
 </plist>`;
 }
 function generateSystemdUnit(daemonBin) {
+    // Use a shell wrapper so the service manager loads the self-updated overlay
+    // bundle when it exists, falling back to the original npm-installed binary.
     return `[Unit]
 Description=Parall Daemon
 After=network-online.target
@@ -82,7 +88,7 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=${daemonBin}
+ExecStart=/bin/sh -c 'OVERLAY="$HOME/.parall-daemon/bundle/current/parall-daemon.js"; if [ -f "$OVERLAY" ]; then exec node "$OVERLAY"; else exec ${daemonBin}; fi'
 Restart=always
 RestartSec=5
 
@@ -206,6 +212,46 @@ function cmdServiceUninstall() {
         console.log("Unsupported platform.");
     }
 }
+async function cmdUpdate(checkOnly) {
+    const { resolveClaudeDaemonConfig, resolveBundleDir } = await import("./config.js");
+    const { DaemonUpdater } = await import("./updater.js");
+    const config = resolveClaudeDaemonConfig(process.env);
+    const bundleDir = resolveBundleDir(process.env);
+    const signingEnabled = !!process.env.PRLL_DAEMON_SIGNING_PUBLIC_KEY;
+    const updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, {
+        info: (msg) => console.log(msg),
+        warn: (msg) => console.warn(msg),
+        error: (msg) => console.error(msg),
+    }, signingEnabled);
+    const local = updater.getLocalVersion();
+    console.log(`Current version: ${local ?? "unknown"}`);
+    console.log(`CDN: ${config.updateCdnUrl}`);
+    console.log(`Bundle dir: ${bundleDir}`);
+    if (checkOnly) {
+        console.log("\nChecking for updates...");
+        const result = await updater.checkAvailable();
+        if (result.available) {
+            console.log(`Update available: ${result.currentVersion ?? "unknown"} → ${result.remoteVersion}`);
+        }
+        else if (result.remoteVersion) {
+            console.log(`Already up to date (${result.currentVersion}).`);
+        }
+        else {
+            console.log("Could not check for updates.");
+        }
+        return;
+    }
+    else {
+        console.log("\nChecking and applying updates...");
+    }
+    const applied = await updater.checkAndApply();
+    if (applied) {
+        console.log("Update applied. Restart the daemon to use the new version.");
+    }
+    else {
+        console.log("Already up to date.");
+    }
+}
 function printUsage() {
     console.log(`
 parall-daemon — Parall local agent runtime
@@ -215,6 +261,7 @@ Usage:
   parall-daemon init               Configure the daemon (interactive)
   parall-daemon status             Show daemon service status
   parall-daemon stop               Stop the background service
+  parall-daemon update [--check]   Check for / apply daemon updates
   parall-daemon logs [-n LINES]    Tail daemon logs
   parall-daemon service install    Install as background service (launchd/systemd)
   parall-daemon service uninstall  Uninstall background service
@@ -246,6 +293,9 @@ export async function runCLI(args) {
             cmdLogs(lines);
             return "handled";
         }
+        case "update":
+            await cmdUpdate(args.includes("--check"));
+            return "handled";
         case "service": {
             const sub = args[1];
             if (sub === "install") {

package/dist/config.d.ts

@@ -47,6 +47,12 @@ export type ClaudeDaemonConfig = {
      */
     supervisorRestartBackoffMs: number;
     supervisorRestartBackoffMaxMs: number;
+    /** CDN base URL for daemon bundle manifest (includes channel prefix). */
+    updateCdnUrl: string;
+    /** Update check interval in ms. Default 6h. Set 0 to disable periodic check. */
+    updateIntervalMs: number;
+    /** Disable self-update entirely (K8s env auto-disables). */
+    updateDisabled: boolean;
 };
 export declare function daemonConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function daemonConfigPath(env?: NodeJS.ProcessEnv): string;
@@ -63,5 +69,12 @@ export declare function sharedClaudeCredentialsFileFor(rootClaudeHome: string):
 export declare function agentClaudeCredentialsFileFor(agentClaudeHome: string): string;
 /** Per-agent workspace dir where the agent runs git commands. */
 export declare function agentWorkspaceDirFor(rootStateDir: string, agentId: string): string;
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export declare function resolveBundleDir(env?: NodeJS.ProcessEnv): string;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;CACvC,CAAC;AA2BF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CA6ClG;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AA2BF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAmDlG;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG"}

package/dist/config.js

@@ -91,6 +91,12 @@ export function resolveClaudeDaemonConfig(env = process.env) {
         bootstrapBackoffMaxMs: parseMs(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MAX_MS, 60_000),
         supervisorRestartBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS, 5_000),
         supervisorRestartBackoffMaxMs: parseMs(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MAX_MS, 5 * 60_000),
+        updateCdnUrl: env.PRLL_DAEMON_UPDATE_CDN_URL?.trim() ||
+            ((env.PRLL_DAEMON_UPDATE_CHANNEL?.trim() ?? "production") === "staging"
+                ? "https://releases.staging.prll.sh/daemon/staging"
+                : "https://releases.parall.com/daemon/production"),
+        updateIntervalMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_INTERVAL_MS, 6 * 60 * 60_000),
+        updateDisabled: env.PRLL_DAEMON_UPDATE_DISABLED === "true" || !!env.KUBERNETES_SERVICE_HOST,
     };
 }
 function assertSafeAgentId(agentId) {
@@ -121,6 +127,17 @@ export function agentClaudeCredentialsFileFor(agentClaudeHome) {
 export function agentWorkspaceDirFor(rootStateDir, agentId) {
     return path.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
 }
+/**
+ * Resolve the bundle directory for self-update storage.
+ * Desktop: ~/Library/Application Support/Parall/daemon/ (set via env)
+ * Default: ~/.parall-daemon/bundle/ — always a writable overlay directory,
+ * never the npm global install dir (which may be root-owned or read-only).
+ */
+export function resolveBundleDir(env = process.env) {
+    if (env.PRLL_DAEMON_BUNDLE_DIR)
+        return resolvePath(env.PRLL_DAEMON_BUNDLE_DIR);
+    return path.join(daemonConfigDir(env), "bundle");
+}
 export function resolveWsUrl(apiUrl, explicitWsUrl, swimlaneName) {
     const base = explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
     if (!swimlaneName)

package/dist/index.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import { createLogger } from "@parall/agent-core";
 import { ParallClient } from "@parall/sdk";
-import { resolveClaudeDaemonConfig, resolveWsUrl } from "./config.js";
+import { resolveClaudeDaemonConfig, resolveBundleDir, resolveWsUrl } from "./config.js";
 import { DaemonSupervisor, sleepCancellable } from "./supervisor.js";
+import { DaemonUpdater } from "./updater.js";
 import { runCLI } from "./cli.js";
+const UPDATE_EXIT_CODE = 42;
 const log = createLogger("daemon");
 function formatError(reason) {
     if (reason instanceof Error) {
@@ -30,10 +32,12 @@ function formatError(reason) {
  * any supervisor.run() rejection and rely entirely on the shell wrapper +
  * K8s for restart.
  */
-async function runForever(config, client, log, signal) {
+async function runForever(config, client, log, signal, updater) {
     let attempt = 0;
     while (!signal.aborted) {
         const supervisor = new DaemonSupervisor(config, client, log);
+        if (updater)
+            supervisor.setUpdater(updater);
         try {
             await supervisor.run(signal);
             // Clean exit (signal aborted) — done.
@@ -70,6 +74,17 @@ async function main() {
     const config = resolveClaudeDaemonConfig(process.env);
     log.info(`boot: api=${config.apiUrl} pollMs=${config.pollIntervalMs} heartbeatMs=${config.heartbeatIntervalMs} agentBin=${config.agentBin}`);
     log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
+    // --- Self-update: rollback check (before any network calls) ---
+    let updater = null;
+    if (!config.updateDisabled) {
+        const bundleDir = resolveBundleDir(process.env);
+        updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, log, true);
+        if (updater.checkRollback()) {
+            log.info("rollback applied — exiting for service manager restart");
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        log.info(`update: bundleDir=${bundleDir} cdn=${config.updateCdnUrl} interval=${config.updateIntervalMs}ms`);
+    }
     // The daemon talks to the API as a Machine — the bearer is mck_*.
     // No orgId is configured here; per-agent subprocesses get their
     // own org_id via the spawn env.
@@ -97,7 +112,19 @@ async function main() {
         process.exit(1);
     });
     config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
-    await runForever(config, client, log, abortController.signal);
+    // --- Self-update: boot check + periodic timer ---
+    if (updater) {
+        const applied = await updater.checkAndApply().catch((err) => {
+            log.warn(`boot update check failed: ${String(err)}`);
+            return false;
+        });
+        if (applied) {
+            log.info("boot update applied — exiting for restart");
+            process.exit(UPDATE_EXIT_CODE);
+        }
+        updater.startPeriodicCheck(config.updateIntervalMs);
+    }
+    await runForever(config, client, log, abortController.signal, updater);
 }
 const cliArgs = process.argv.slice(2);
 runCLI(cliArgs)

package/dist/runtimes.d.ts

@@ -1,10 +1,7 @@
-export interface ProviderConfig {
-    llm_source?: string;
-    openai_api_key?: string;
-    openai_base_url?: string;
-    anthropic_auth_token?: string;
-    anthropic_base_url?: string;
-}
+import { clearAllProviderCreds } from "@parall/agent-core";
+import type { ProviderConfig } from "@parall/agent-core";
+export type { ProviderConfig };
+export { clearAllProviderCreds };
 export interface RuntimeAdapter {
     bin: string;
     buildEnv(baseEnv: NodeJS.ProcessEnv, agentId: string, orgId: string, apiKey: string, dirs: AgentDirs, pc?: ProviderConfig): NodeJS.ProcessEnv;
@@ -14,7 +11,11 @@ export interface AgentDirs {
     workspaceDir: string;
     claudeHome: string;
 }
-export declare function clearAllProviderCreds(env: NodeJS.ProcessEnv): void;
+/**
+ * Resolve a runtime adapter, preferring overlay bundle paths when available.
+ * When the daemon has self-updated into ~/.parall-daemon/bundle/, bridge
+ * binaries should also load from overlay to keep versions in sync.
+ */
 export declare function getRuntimeAdapter(runtimeType: string): RuntimeAdapter;
 export declare function assertAgentKey(apiKey: string): void;
 //# sourceMappingURL=runtimes.d.ts.map

package/dist/runtimes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;CAC/I;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAOlE;AAgGD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAErE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}
+{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;CAC/I;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AA4DD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAerE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}

package/dist/runtimes.js

@@ -1,107 +1,47 @@
+import * as fs from "node:fs";
 import * as path from "node:path";
-function llmSource(pc) {
-    if (pc?.llm_source)
-        return pc.llm_source;
-    if (pc?.openai_api_key ||
-        pc?.openai_base_url ||
-        pc?.anthropic_auth_token ||
-        pc?.anthropic_base_url) {
-        return "custom";
-    }
-    return "parall";
-}
-export function clearAllProviderCreds(env) {
-    delete env.ANTHROPIC_AUTH_TOKEN;
-    delete env.ANTHROPIC_BASE_URL;
-    delete env.ANTHROPIC_API_KEY;
-    delete env.OPENAI_API_KEY;
-    delete env.OPENAI_BASE_URL;
-    delete env.PRLL_CLAUDE_ALLOW_API_KEY;
+import { clearAllProviderCreds } from "@parall/agent-core";
+import { resolveBundleDir } from "./config.js";
+export { clearAllProviderCreds };
+function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
+    const env = { ...baseEnv };
+    clearAllProviderCreds(env);
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_STATE_DIR = dirs.stateDir;
+    env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
+    if (pc)
+        env.PRLL_PROVIDER_CONFIG = JSON.stringify(pc);
+    delete env.PRLL_DAEMON_MODE;
+    return env;
 }
 const claudeCodeAdapter = {
     bin: "parall-claude-agent",
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.PRLL_CLAUDE_HOME = dirs.claudeHome;
-        env.PRLL_CLAUDE_STATE_DIR = dirs.stateDir;
-        env.PRLL_CLAUDE_WORKSPACE_DIR = dirs.workspaceDir;
-        const source = llmSource(pc);
-        if (source === "parall") {
-            env.ANTHROPIC_AUTH_TOKEN = apiKey;
-            env.ANTHROPIC_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm`;
-            env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
-        }
-        else if (source === "custom") {
-            if (pc?.anthropic_auth_token) {
-                env.ANTHROPIC_AUTH_TOKEN = pc.anthropic_auth_token;
-                env.PRLL_CLAUDE_ALLOW_API_KEY = "1";
-            }
-            if (pc?.anthropic_base_url)
-                env.ANTHROPIC_BASE_URL = pc.anthropic_base_url;
-        }
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
 const codexAdapter = {
     bin: "parall-codex-agent",
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_CODEX_STATE_DIR = dirs.stateDir;
-        env.PRLL_CODEX_WORKSPACE_DIR = dirs.workspaceDir;
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.PRLL_CODEX_HOME = path.join(dirs.stateDir, ".codex");
-        const source = llmSource(pc);
-        if (source === "parall") {
-            env.OPENAI_API_KEY = apiKey;
-            env.OPENAI_BASE_URL = `${baseEnv.PRLL_API_URL}/api/llm/v1`;
-        }
-        else if (source === "custom") {
-            if (pc?.openai_api_key)
-                env.OPENAI_API_KEY = pc.openai_api_key;
-            if (pc?.openai_base_url)
-                env.OPENAI_BASE_URL = pc.openai_base_url;
-        }
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
 const defaultAdapter = {
     bin: "parall-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
-        const env = { ...baseEnv };
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_STATE_DIR = dirs.stateDir;
-        env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
-        delete env.PRLL_DAEMON_MODE;
-        return env;
-    },
+    buildEnv: buildStandardEnv,
 };
 const openclawAdapter = {
     bin: "parall-openclaw-agent",
-    buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
-        const env = { ...baseEnv };
-        clearAllProviderCreds(env);
-        env.PRLL_API_KEY = apiKey;
-        env.PRLL_ORG_ID = orgId;
-        env.AGENT_ID = agentId;
-        env.PRLL_AGENT_ID = agentId;
-        env.PRLL_OPENCLAW_STATE_DIR = dirs.stateDir;
-        env.PRLL_OPENCLAW_WORKSPACE_DIR = dirs.workspaceDir;
+    buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
+        const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         env.OPENCLAW_GATEWAY_PORT = env.OPENCLAW_GATEWAY_PORT || "0";
-        delete env.PRLL_DAEMON_MODE;
         return env;
     },
 };
@@ -110,8 +50,32 @@ const RUNTIME_ADAPTERS = {
     "codex": codexAdapter,
     "openclaw": openclawAdapter,
 };
+const OVERLAY_BIN_NAMES = {
+    "claude-code": "parall-claude-agent.js",
+    "codex": "parall-codex-agent.js",
+    "openclaw": "parall-openclaw-agent.js",
+};
+/**
+ * Resolve a runtime adapter, preferring overlay bundle paths when available.
+ * When the daemon has self-updated into ~/.parall-daemon/bundle/, bridge
+ * binaries should also load from overlay to keep versions in sync.
+ */
 export function getRuntimeAdapter(runtimeType) {
-    return RUNTIME_ADAPTERS[runtimeType] ?? defaultAdapter;
+    const base = RUNTIME_ADAPTERS[runtimeType] ?? defaultAdapter;
+    const overlayName = OVERLAY_BIN_NAMES[runtimeType];
+    if (!overlayName)
+        return base;
+    try {
+        const bundleDir = resolveBundleDir();
+        const overlayBin = path.join(bundleDir, "current", overlayName);
+        if (fs.existsSync(overlayBin)) {
+            return { ...base, bin: overlayBin };
+        }
+    }
+    catch {
+        // resolveBundleDir may fail in unusual setups; fall through
+    }
+    return base;
 }
 export function assertAgentKey(apiKey) {
     if (apiKey.startsWith("mck_")) {

package/dist/supervisor.d.ts

@@ -1,5 +1,6 @@
 import type { GatewayLogger } from "@parall/agent-core";
 import { ParallClient } from "@parall/sdk";
+import type { DaemonUpdater } from "./updater.js";
 import { type ClaudeDaemonConfig } from "./config.js";
 /**
  * Sleep that wakes early on abort. Returns true if the full delay elapsed,
@@ -33,7 +34,10 @@ export declare class DaemonSupervisor {
     private machineOrgId;
     private machineLlmSource;
     private stopResolve;
+    private updater;
+    private healthConfirmed;
     constructor(config: ClaudeDaemonConfig, client: ParallClient, log: GatewayLogger);
+    setUpdater(updater: DaemonUpdater): void;
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     run(signal: AbortSignal): Promise<void>;
     /** Disconnect WS, cancel timers, SIGTERM all children, await exit. */

package/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAA6P,MAAM,aAAa,CAAC;AAEtS,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAiBrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAazB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAdtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;gBAG7B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsF7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAiCb,kBAAkB;YAqClB,aAAa;IAqD3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,sBAAsB;YAwBtB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;YAcpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IA2D5B,OAAO,CAAC,UAAU;YA0EJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAqR,MAAM,aAAa,CAAC;AAC9T,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAiBrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAezB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAhBtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,eAAe,CAAS;gBAGb,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsH7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAiCb,kBAAkB;YAqClB,aAAa;IAqD3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,sBAAsB;YAwBtB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;YAcpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IA2D5B,OAAO,CAAC,UAAU;YA0EJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CA8BnC"}

package/dist/supervisor.js

@@ -58,11 +58,16 @@ export class DaemonSupervisor {
     machineOrgId = null;
     machineLlmSource = "parall";
     stopResolve = null;
+    updater = null;
+    healthConfirmed = false;
     constructor(config, client, log) {
         this.config = config;
         this.client = client;
         this.log = log;
     }
+    setUpdater(updater) {
+        this.updater = updater;
+    }
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     async run(signal) {
         if (this.running)
@@ -85,6 +90,11 @@ export class DaemonSupervisor {
             throw err;
         }
         this.migrateFlatLayout();
+        // Report daemon version via heartbeat (best-effort)
+        const daemonVersion = this.updater?.getLocalVersion();
+        if (daemonVersion) {
+            this.client.postMachineHeartbeat(daemonVersion).catch((err) => this.log.warn(`daemon version report failed: ${String(err)}`));
+        }
         await this.fullReconcile();
         this.ws = new ParallWs({
             getTicket: () => this.client.getMachineWsTicket(),
@@ -93,11 +103,34 @@ export class DaemonSupervisor {
         });
         this.ws.on("machine.hello", (_data) => {
             this.log.info("machine WS connected (machine.hello)");
+            if (!this.healthConfirmed && this.updater) {
+                try {
+                    this.updater.confirmVersion();
+                    this.healthConfirmed = true;
+                }
+                catch (err) {
+                    this.log.warn(`confirmVersion failed: ${String(err)}`);
+                }
+            }
             void (async () => {
                 await this.refreshMachineConfig();
                 await this.fullReconcile();
             })();
         });
+        this.ws.on("machine.update", (data) => {
+            this.log.info(`WS: daemon update available — version=${data.new_version} mandatory=${data.mandatory}`);
+            if (this.updater) {
+                void this.updater.triggerUpdate(data.new_version, data.mandatory).then(async (applied) => {
+                    if (applied) {
+                        this.log.info("daemon update applied — stopping supervisor before restart");
+                        await this.stop();
+                        process.exit(42);
+                    }
+                }).catch((err) => {
+                    this.log.warn(`daemon update failed: ${String(err)}`);
+                });
+            }
+        });
         this.ws.on("machine.agent.attached", (data) => {
             this.log.info(`WS: agent ${data.agent_id} attached`);
             void this.handleAgentAttached(data.agent_id);

package/dist/updater-manifest.d.ts

@@ -0,0 +1,39 @@
+export interface ManifestFile {
+    sha256: string;
+    size: number;
+}
+export interface RemoteManifest {
+    version: string;
+    built_at: string;
+    min_daemon_version?: string;
+    files: Record<string, ManifestFile>;
+    signature: string;
+}
+export interface LocalManifest {
+    version: string;
+    built_at: string;
+    files: Record<string, ManifestFile>;
+}
+/**
+ * Recursively sort all object keys at every depth for deterministic JSON output.
+ * Arrays preserve order; primitives pass through.
+ */
+export declare function canonicalize(obj: unknown): unknown;
+/**
+ * Verify the Ed25519 signature of a remote manifest.
+ * Signs canonical JSON of all fields except `signature`.
+ */
+export declare function verifyManifestSignature(manifest: RemoteManifest, publicKey: string): boolean;
+/**
+ * Compare two semver strings (including prerelease tags). Returns:
+ *   -1 if a < b
+ *    0 if a == b
+ *    1 if a > b
+ *   null if either is not valid semver
+ *
+ * Prerelease ordering follows SemVer 2.0: a version with prerelease has
+ * lower precedence than the same version without prerelease. Prerelease
+ * identifiers are compared lexicographically when both present.
+ */
+export declare function semverCompare(a: string, b: string): number | null;
+//# sourceMappingURL=updater-manifest.d.ts.map

package/dist/updater-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater-manifest.d.ts","sourceRoot":"","sources":["../src/updater-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}