@parall/daemon 1.30.0 → 1.32.0

package/dist/supervisor.js

@@ -1,15 +1,18 @@
-import { spawn } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { ParallWs } from "@parall/sdk";
-import { listDirectory } from "./filesystem.js";
-import { agentClaudeCredentialsFileFor, agentClaudeHomeFor, agentStateDirFor, agentWorkspaceDirFor, sharedClaudeCredentialsFileFor, } from "./config.js";
-import { assertAgentKey, getRuntimeAdapter } from "./runtimes.js";
-import { prepareWorkspace } from "./workspace.js";
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { effectiveLLMSourceExplicit } from '@parall/agent-core';
+import { ParallWs, } from '@parall/sdk';
+import { listDirectory } from './filesystem.js';
+import { agentClaudeCredentialsFileFor, agentClaudeHomeFor, agentStateDirFor, agentWorkspaceDirFor, sharedClaudeCredentialsFileFor, } from './config.js';
+import { assertAgentKey, getRuntimeAdapter } from './runtimes.js';
+import { prepareWorkspace } from './workspace.js';
+import { ClipProcessManager, ClipProvider } from './clip-runtime/index.js';
+import { installClip, parseSource } from './clip-runtime/clip-installer.js';
 const RUNTIME_PACKAGES = {
     'claude-code': '@parall/claude-agent',
-    'codex': '@parall/codex-agent',
-    'openclaw': '@parall/openclaw-agent',
+    codex: '@parall/codex-agent',
+    openclaw: '@parall/openclaw-agent',
 };
 const WORKSPACE_SETUP_RETRY_DELAY_MS = 5_000;
 /**
@@ -22,14 +25,14 @@ function sleepCancellable(ms, signal) {
         return Promise.resolve(false);
     return new Promise((resolve) => {
         const timer = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
+            signal.removeEventListener('abort', onAbort);
             resolve(true);
         }, ms);
         const onAbort = () => {
             clearTimeout(timer);
             resolve(false);
         };
-        signal.addEventListener("abort", onAbort, { once: true });
+        signal.addEventListener('abort', onAbort, { once: true });
     });
 }
 export { sleepCancellable };
@@ -55,79 +58,152 @@ export class DaemonSupervisor {
     cancelledSpawns = new Set();
     ws = null;
     running = false;
+    machineId = null;
     machineOrgId = null;
-    machineLlmSource = "parall";
+    machineLlmSource = 'parall';
     stopResolve = null;
+    updater = null;
+    healthConfirmed = false;
+    clipManager = null;
+    clipProvider = null;
     constructor(config, client, log) {
         this.config = config;
         this.client = client;
         this.log = log;
     }
+    setUpdater(updater) {
+        this.updater = updater;
+    }
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
     async run(signal) {
         if (this.running)
-            throw new Error("supervisor already running");
+            throw new Error('supervisor already running');
         this.running = true;
         const onAbort = () => {
             this.stop().catch((err) => this.log.error(`stop() failed: ${String(err)}`));
         };
-        signal.addEventListener("abort", onAbort, { once: true });
+        signal.addEventListener('abort', onAbort, { once: true });
         try {
             if (!(await this.bootstrapWithRetry(signal))) {
-                signal.removeEventListener("abort", onAbort);
+                signal.removeEventListener('abort', onAbort);
                 this.running = false;
                 return;
             }
         }
         catch (err) {
-            signal.removeEventListener("abort", onAbort);
+            signal.removeEventListener('abort', onAbort);
             this.running = false;
             throw err;
         }
         this.migrateFlatLayout();
+        // Initialize Clip runtime manager (optional, for Pinix Clip subprocess management)
+        if (process.env.PRLL_CLIP_RUNTIME_ENABLED === 'true') {
+            this.clipManager = new ClipProcessManager({
+                clipsDir: path.join(this.config.rootStateDir, 'clips'),
+                dataDir: path.join(this.config.rootStateDir, 'clip-data'),
+            });
+            try {
+                await this.clipManager.loadInstalledClips();
+            }
+            catch (err) {
+                this.log.warn(`clip runtime init failed: ${String(err)}`);
+            }
+            // Connect to Clip Service as a Provider when URL is configured
+            const clipServiceUrl = process.env.PRLL_CLIP_SERVICE_URL?.trim();
+            if (clipServiceUrl && this.machineOrgId && this.machineId) {
+                this.clipProvider = new ClipProvider({
+                    serviceUrl: clipServiceUrl,
+                    authKey: this.config.apiKey,
+                    orgId: this.machineOrgId,
+                    providerName: `daemon-${this.machineId}`,
+                    clipManager: this.clipManager,
+                    log: this.log,
+                });
+                this.clipProvider
+                    .connect()
+                    .catch((err) => this.log.warn(`clip provider connect failed: ${String(err)}`));
+            }
+        }
+        // Report daemon version via heartbeat (best-effort)
+        const daemonVersion = this.updater?.getLocalVersion();
+        if (daemonVersion) {
+            this.client
+                .postMachineHeartbeat(daemonVersion)
+                .catch((err) => this.log.warn(`daemon version report failed: ${String(err)}`));
+        }
         await this.fullReconcile();
         this.ws = new ParallWs({
             getTicket: () => this.client.getMachineWsTicket(),
             wsUrl: this.config.wsUrl,
             reconnect: true,
         });
-        this.ws.on("machine.hello", (_data) => {
-            this.log.info("machine WS connected (machine.hello)");
+        this.ws.on('machine.hello', (_data) => {
+            this.log.info('machine WS connected (machine.hello)');
+            if (!this.healthConfirmed && this.updater) {
+                try {
+                    this.updater.confirmVersion();
+                    this.healthConfirmed = true;
+                }
+                catch (err) {
+                    this.log.warn(`confirmVersion failed: ${String(err)}`);
+                }
+            }
             void (async () => {
                 await this.refreshMachineConfig();
                 await this.fullReconcile();
             })();
         });
-        this.ws.on("machine.agent.attached", (data) => {
+        this.ws.on('machine.update', (data) => {
+            this.log.info(`WS: daemon update available — version=${data.new_version} mandatory=${data.mandatory}`);
+            if (this.updater) {
+                void this.updater
+                    .triggerUpdate(data.new_version, data.mandatory)
+                    .then(async (applied) => {
+                    if (applied) {
+                        this.log.info('daemon update applied — stopping supervisor before restart');
+                        await this.stop();
+                        process.exit(42);
+                    }
+                })
+                    .catch((err) => {
+                    this.log.warn(`daemon update failed: ${String(err)}`);
+                });
+            }
+        });
+        this.ws.on('machine.agent.attached', (data) => {
             this.log.info(`WS: agent ${data.agent_id} attached`);
             void this.handleAgentAttached(data.agent_id);
         });
-        this.ws.on("machine.agent.detached", (data) => {
+        this.ws.on('machine.agent.detached', (data) => {
             this.log.info(`WS: agent ${data.agent_id} detached`);
             void this.handleAgentDetached(data.agent_id);
         });
-        this.ws.on("machine.config.updated", (data) => {
-            const newSource = data.llm_source ?? "parall";
+        this.ws.on('machine.config.updated', (data) => {
+            const newSource = data.llm_source ?? 'parall';
             if (newSource !== this.machineLlmSource) {
                 this.log.info(`WS: llm_source changed ${this.machineLlmSource} → ${newSource}, respawning all agents`);
                 this.machineLlmSource = newSource;
                 void this.respawnAllChildren();
             }
         });
-        this.ws.on("machine.workspace.setup.requested", (data) => {
+        this.ws.on('machine.workspace.setup.requested', (data) => {
             this.log.info(`WS: workspace setup requested for agent ${data.agent_id}`);
             void this.handleWorkspaceSetupRequested(data.agent_id);
         });
-        this.ws.on("machine.filesystem.browse", (data) => {
+        this.ws.on('machine.filesystem.browse', (data) => {
             this.log.info(`WS: filesystem browse requested: ${data.path}`);
             void this.handleFilesystemBrowse(data.request_id, data.path);
         });
-        this.ws.on("machine.stop", (data) => {
-            this.log.info(`WS: machine.stop received (reason=${data.reason ?? "none"})`);
+        this.ws.on('machine.stop', (data) => {
+            this.log.info(`WS: machine.stop received (reason=${data.reason ?? 'none'})`);
             void this.stop();
         });
+        this.ws.on('machine.clip.install', (data) => {
+            this.log.info(`WS: clip install requested — alias=${data.alias} source=${data.source_ref}`);
+            void this.handleClipInstall(data);
+        });
         this.ws.onStateChange((state) => {
-            if (state === "disconnected" || state === "reconnecting") {
+            if (state === 'disconnected' || state === 'reconnecting') {
                 this.log.warn(`machine WS state: ${state}`);
             }
         });
@@ -135,7 +211,7 @@ export class DaemonSupervisor {
         await new Promise((resolve) => {
             this.stopResolve = resolve;
         });
-        signal.removeEventListener("abort", onAbort);
+        signal.removeEventListener('abort', onAbort);
     }
     /** Disconnect WS, cancel timers, SIGTERM all children, await exit. */
     async stop() {
@@ -159,9 +235,17 @@ export class DaemonSupervisor {
             }
             exits.push(this.terminateChild(state));
         }
+        if (this.clipProvider) {
+            exits.push(this.clipProvider.disconnect());
+            this.clipProvider = null;
+        }
+        if (this.clipManager) {
+            exits.push(this.clipManager.stopAll());
+            this.clipManager = null;
+        }
         await Promise.allSettled(exits);
         this.children.clear();
-        this.log.info("daemon supervisor stopped");
+        this.log.info('daemon supervisor stopped');
         if (this.stopResolve) {
             this.stopResolve();
             this.stopResolve = null;
@@ -173,8 +257,9 @@ export class DaemonSupervisor {
         while (this.running && !signal.aborted) {
             try {
                 const machine = await this.client.getMachineSelf();
+                this.machineId = machine.id;
                 this.machineOrgId = machine.org_id;
-                this.machineLlmSource = machine.llm_source ?? "parall";
+                this.machineLlmSource = machine.llm_source ?? 'parall';
                 this.log.info(`daemon online — machine_id=${machine.id} org=${machine.org_id} label=${machine.label}`);
                 return true;
             }
@@ -216,7 +301,7 @@ export class DaemonSupervisor {
                 this.log.warn(`skipping attached entry with no user_id (profile=${JSON.stringify(a.profile)})`);
                 continue;
             }
-            if (a.user && a.user.status !== "active") {
+            if (a.user && a.user.status !== 'active') {
                 this.log.info(`agent ${userId} not active (status=${a.user.status}) — skipping`);
                 continue;
             }
@@ -231,7 +316,7 @@ export class DaemonSupervisor {
                 await this.spawnAgent(userId, orgId, a);
             }
             else if (!existing.child && !existing.restartTimer && !existing.shuttingDown) {
-                await this.restartChildNow(existing, "reconcile found no live child");
+                await this.restartChildNow(existing, 'reconcile found no live child');
             }
         }
         for (const [userId, state] of this.children) {
@@ -246,6 +331,9 @@ export class DaemonSupervisor {
                 this.children.delete(userId);
             }
         }
+        // Reconcile desired clip installs alongside agents (best-effort; never
+        // blocks agent reconcile).
+        await this.reconcileClipInstalls();
     }
     // ---- Flat layout migration (self-hosted → daemon) ----
     /**
@@ -255,21 +343,21 @@ export class DaemonSupervisor {
      */
     migrateFlatLayout() {
         const root = this.config.rootStateDir;
-        const agentsDir = path.join(root, "agents");
-        const flatWorkspace = path.join(root, "workspace");
+        const agentsDir = path.join(root, 'agents');
+        const flatWorkspace = path.join(root, 'workspace');
         if (!fs.existsSync(flatWorkspace) || fs.existsSync(agentsDir))
             return;
         let ownerAgentId;
-        const sessionsDir = path.join(root, "sessions");
+        const sessionsDir = path.join(root, 'sessions');
         if (fs.existsSync(sessionsDir)) {
             try {
                 for (const file of fs.readdirSync(sessionsDir)) {
-                    if (!file.endsWith(".json"))
+                    if (!file.endsWith('.json'))
                         continue;
-                    const decoded = Buffer.from(file.replace(".json", ""), "base64url").toString();
+                    const decoded = Buffer.from(file.replace('.json', ''), 'base64url').toString();
                     // runtimeKey format: "agent:main:{runtime}:{agentId}:orchestrator"
-                    const parts = decoded.split(":");
-                    if (parts.length >= 4 && parts[3].startsWith("usr_")) {
+                    const parts = decoded.split(':');
+                    if (parts.length >= 4 && parts[3].startsWith('usr_')) {
                         ownerAgentId = parts[3];
                         break;
                     }
@@ -279,11 +367,11 @@ export class DaemonSupervisor {
                 // best-effort scan
             }
         }
-        const targetId = ownerAgentId ?? "_orphan";
+        const targetId = ownerAgentId ?? '_orphan';
         const targetDir = path.join(agentsDir, targetId);
         try {
             fs.mkdirSync(targetDir, { recursive: true });
-            for (const sub of ["workspace", "sessions", "dispatch-context"]) {
+            for (const sub of ['workspace', 'sessions', 'dispatch-context']) {
                 const src = path.join(root, sub);
                 if (fs.existsSync(src)) {
                     fs.renameSync(src, path.join(targetDir, sub));
@@ -303,24 +391,24 @@ export class DaemonSupervisor {
         }
         catch (err) {
             this.log.warn(`fetchAttachedAgent: listAttachedAgents failed: ${String(err)}`);
-            return { kind: "retryable" };
+            return { kind: 'retryable' };
         }
         const entry = attached.find((a) => (a.user?.id ?? a.profile.user_id) === agentId);
         if (!entry) {
             this.log.warn(`fetchAttachedAgent: agent ${agentId} not found in attached list`);
-            return { kind: "skip" };
+            return { kind: 'skip' };
         }
-        if (entry.user && entry.user.status !== "active") {
+        if (entry.user && entry.user.status !== 'active') {
             this.log.info(`agent ${agentId} not active (status=${entry.user.status}) — skipping`);
-            return { kind: "skip" };
+            return { kind: 'skip' };
         }
-        return { kind: "found", entry };
+        return { kind: 'found', entry };
     }
     async handleAgentAttached(agentId) {
         if (this.children.has(agentId) || this.spawningAgents.has(agentId))
             return;
         const result = await this.fetchAttachedAgent(agentId);
-        if (result.kind !== "found") {
+        if (result.kind !== 'found') {
             return;
         }
         const orgId = this.machineOrgId;
@@ -373,6 +461,97 @@ export class DaemonSupervisor {
             }
         }
     }
+    async handleClipInstall(data) {
+        if (!this.clipManager) {
+            this.log.warn('clip install event received but clip runtime is disabled');
+            return false;
+        }
+        try {
+            // Idempotency guard: if the clip is already installed and running
+            // locally, a prior install succeeded but its server ACK
+            // (reportClipInstall) may have failed — the desired-state row is still
+            // pending, so reconcile re-sent the same directive. Don't re-download or
+            // restart a healthy clip; just retry the report so pending → installed.
+            if (this.clipManager.isRunning(data.alias)) {
+                this.log.info(`clip already running, re-reporting install: ${data.alias}`);
+                await this.client.reportClipInstall(data.clip_id, data.version).catch((err) => {
+                    this.log.warn(`clip install re-report failed for ${data.alias}: ${String(err)}`);
+                });
+                return true;
+            }
+            const clipsDir = path.join(this.config.rootStateDir, 'clips');
+            // The clip record stores a resolved version; pin the install to it when
+            // the source ref is unversioned, otherwise an unversioned source like
+            // "@pinix/github-tools" would silently fetch latest instead.
+            let source = data.source_ref;
+            if (data.version) {
+                let sourceHasVersion = false;
+                try {
+                    sourceHasVersion = !!parseSource(source).version;
+                }
+                catch {
+                    /* fall through to append */
+                }
+                if (!sourceHasVersion)
+                    source = `${source}@${data.version}`;
+            }
+            const result = await installClip({
+                source,
+                alias: data.alias,
+                clipsDir,
+                // Pinix registry REST base; falls back to the installer default when unset.
+                registryUrl: process.env.PRLL_PINIX_REGISTRY_URL?.trim() || undefined,
+            });
+            this.log.info(`clip installed: ${result.alias} v${result.version} at ${result.path}`);
+            this.clipManager.registerClip({
+                name: result.alias,
+                package: result.name,
+                version: result.version,
+                source: result.path,
+                path: result.path,
+            });
+            await this.clipManager.startClip(result.alias);
+            this.log.info(`clip started: ${result.alias}`);
+            // Report success so the server flips the desired-state row pending →
+            // installed. Reporting here (not in the caller) covers both the live WS
+            // broadcast and the durable reconcile paths with one report.
+            await this.client.reportClipInstall(data.clip_id, data.version).catch((err) => {
+                this.log.warn(`clip install report failed for ${data.alias}: ${String(err)}`);
+            });
+            return true;
+        }
+        catch (err) {
+            this.log.error(`clip install failed: ${String(err)}`);
+            return false;
+        }
+    }
+    // Durable reconcile: pull the registry clips this machine should have (covers
+    // installs broadcast while the daemon was offline, and clips targeted at
+    // machines that joined later), install the missing ones, and report success
+    // so the server flips the desired-state row pending → installed. Mirrors the
+    // listAttachedAgents reconcile pattern; runs on every fullReconcile.
+    async reconcileClipInstalls() {
+        if (!this.clipManager)
+            return; // clip runtime disabled — nothing to reconcile
+        let desired;
+        try {
+            desired = await this.client.listClipInstalls();
+        }
+        catch (err) {
+            this.log.warn(`reconcileClipInstalls: list failed: ${String(err)}`);
+            return;
+        }
+        for (const d of desired) {
+            // handleClipInstall reports success to the server on its own, so the
+            // reconcile loop just drives the install for each desired clip.
+            await this.handleClipInstall({
+                clip_id: d.clip_id,
+                alias: d.alias,
+                source_ref: d.source_ref ?? '',
+                version: d.version,
+            });
+        }
+    }
     async handleWorkspaceSetupRequested(agentId) {
         if (this.spawningAgents.has(agentId)) {
             this.log.info(`agent ${agentId}: workspace setup already in progress; queueing one restart`);
@@ -380,12 +559,12 @@ export class DaemonSupervisor {
             return;
         }
         const result = await this.fetchAttachedAgent(agentId);
-        if (result.kind === "retryable") {
+        if (result.kind === 'retryable') {
             this.pendingWorkspaceSetup.add(agentId);
             this.scheduleWorkspaceSetupRetry(agentId);
             return;
         }
-        if (result.kind === "skip") {
+        if (result.kind === 'skip') {
             this.pendingWorkspaceSetup.delete(agentId);
             this.clearWorkspaceSetupRetry(agentId);
             return;
@@ -432,7 +611,7 @@ export class DaemonSupervisor {
     async refreshMachineConfig() {
         try {
             const machine = await this.client.getMachineSelf();
-            const newSource = machine.llm_source ?? "parall";
+            const newSource = machine.llm_source ?? 'parall';
             if (newSource !== this.machineLlmSource) {
                 this.log.info(`machine config refreshed: llm_source ${this.machineLlmSource} → ${newSource}`);
                 this.machineLlmSource = newSource;
@@ -450,7 +629,7 @@ export class DaemonSupervisor {
         }
         for (const state of states) {
             if (!state.shuttingDown && this.running) {
-                await this.restartChildNow(state, "llm_source changed");
+                await this.restartChildNow(state, 'llm_source changed');
             }
         }
     }
@@ -513,7 +692,7 @@ export class DaemonSupervisor {
         catch (err) {
             this.log.warn(`mkdir agent dirs (${agentId}) failed: ${String(err)}`);
         }
-        const runtimeType = attached.profile.runtime_type ?? "claude-code";
+        const runtimeType = attached.profile.runtime_type ?? 'claude-code';
         let workspaceDir;
         try {
             workspaceDir = await prepareWorkspace({
@@ -538,7 +717,10 @@ export class DaemonSupervisor {
             runtimeType,
             workspacePath: workspaceDir,
             claudeHome,
-            providerConfig: attached.provider_config ?? { llm_source: this.machineLlmSource },
+            // Store the RAW per-agent provider_config; the machine-level fallback is
+            // resolved at startChild time (see resolveProviderConfig) so a respawn
+            // after a machine llm_source change picks up the new source.
+            providerConfig: attached.provider_config,
             child: null,
             credential,
             restartAttempts: 0,
@@ -562,11 +744,25 @@ export class DaemonSupervisor {
             workspaceDir: state.workspacePath,
             claudeHome: state.claudeHome,
         };
-        const env = adapter.buildEnv({ ...process.env, PRLL_API_URL: this.config.apiUrl }, state.agentId, state.orgId, state.credential.api_key, dirs, state.providerConfig);
-        this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} bin=${adapter.bin} (attempt ${state.restartAttempts + 1})`);
-        const child = spawn(adapter.bin, [], {
+        const baseEnv = { ...process.env, PRLL_API_URL: this.config.apiUrl };
+        if (this.machineId)
+            baseEnv.PRLL_MACHINE_ID = this.machineId;
+        // An explicit per-agent provider_config (llm_source or BYO creds) wins;
+        // otherwise defer to the CURRENT machine-level llm_source. The server sends
+        // an empty `{}` for self-hosted agents (per-agent provider_config is
+        // rejected there), and `{} ?? machineLlmSource` would keep the `{}` and
+        // resolve to "parall", silently shadowing the machine's choice — so check
+        // for an explicit signal. Resolved here (not at spawn) so a respawn after a
+        // machine llm_source change applies the new source without a full restart.
+        const effectiveProviderConfig = effectiveLLMSourceExplicit(state.providerConfig)
+            ? state.providerConfig
+            : { llm_source: this.machineLlmSource };
+        const env = adapter.buildEnv(baseEnv, state.agentId, state.orgId, state.credential.api_key, dirs, effectiveProviderConfig);
+        const spawnCmd = adapter.args.length > 0 ? `${adapter.bin} ${adapter.args.join(' ')}` : adapter.bin;
+        this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} cmd=${spawnCmd} (attempt ${state.restartAttempts + 1})`);
+        const child = spawn(adapter.bin, adapter.args, {
             env,
-            stdio: ["ignore", "inherit", "inherit"],
+            stdio: ['ignore', 'inherit', 'inherit'],
             detached: false,
         });
         state.child = child;
@@ -580,10 +776,10 @@ export class DaemonSupervisor {
             const wasShutting = state.shuttingDown;
             state.child = null;
             if (err) {
-                this.log.error(`agent ${state.agentId} child ${event}: ${String(err)}${wasShutting ? " (shutting down)" : ""}`);
+                this.log.error(`agent ${state.agentId} child ${event}: ${String(err)}${wasShutting ? ' (shutting down)' : ''}`);
             }
             else {
-                this.log.info(`agent ${state.agentId} exited code=${code ?? "null"} signal=${signal ?? "null"}${wasShutting ? " (shutting down)" : ""}`);
+                this.log.info(`agent ${state.agentId} exited code=${code ?? 'null'} signal=${signal ?? 'null'}${wasShutting ? ' (shutting down)' : ''}`);
             }
             if (wasShutting || !this.running)
                 return;
@@ -595,14 +791,19 @@ export class DaemonSupervisor {
                 this.startChild(state);
             }, delay);
         };
-        child.once("error", (err) => {
+        child.once('error', (err) => {
             if (err.code === 'ENOENT') {
-                const pkg = RUNTIME_PACKAGES[state.runtimeType] ?? `@parall/${state.runtimeType}-agent`;
-                this.log.error(`Runtime binary "${adapter.bin}" not found in PATH. Install: npm install -g ${pkg}`);
+                if (adapter.args.length > 0) {
+                    this.log.error(`Node runtime "${adapter.bin}" not found — is the Desktop app installed?`);
+                }
+                else {
+                    const pkg = RUNTIME_PACKAGES[state.runtimeType] ?? `@parall/${state.runtimeType}-agent`;
+                    this.log.error(`Runtime binary "${adapter.bin}" not found in PATH. Install: npm install -g ${pkg}`);
+                }
             }
-            settleChild("error", null, null, err);
+            settleChild('error', null, null, err);
         });
-        child.once("close", (code, signal) => settleChild("close", code, signal));
+        child.once('close', (code, signal) => settleChild('close', code, signal));
         const stableTimer = setTimeout(() => {
             if (state.child === child) {
                 state.restartAttempts = 0;
@@ -616,25 +817,25 @@ export class DaemonSupervisor {
             return;
         return new Promise((resolve) => {
             const onExit = () => resolve();
-            child.once("exit", onExit);
+            child.once('exit', onExit);
             try {
-                child.kill("SIGTERM");
+                child.kill('SIGTERM');
             }
             catch (err) {
                 this.log.warn(`SIGTERM ${state.agentId} threw: ${String(err)}`);
-                child.off("exit", onExit);
+                child.off('exit', onExit);
                 resolve();
                 return;
             }
             const hardKill = setTimeout(() => {
                 try {
-                    child.kill("SIGKILL");
+                    child.kill('SIGKILL');
                 }
                 catch {
                     /* already gone */
                 }
             }, 10_000);
-            child.once("exit", () => clearTimeout(hardKill));
+            child.once('exit', () => clearTimeout(hardKill));
         });
     }
     ensureSharedCredentialLink(agentClaudeHome, agentId) {
@@ -661,7 +862,7 @@ export class DaemonSupervisor {
             }
         }
         catch (err) {
-            if (err.code !== "ENOENT") {
+            if (err.code !== 'ENOENT') {
                 throw err;
             }
         }

package/dist/updater-manifest.d.ts

@@ -0,0 +1,41 @@
+export interface ManifestFile {
+    sha256: string;
+    size: number;
+}
+export interface RemoteManifest {
+    version: string;
+    built_at: string;
+    min_daemon_version?: string;
+    min_node_version?: string;
+    files: Record<string, ManifestFile>;
+    signature: string;
+}
+export interface LocalManifest {
+    version: string;
+    built_at: string;
+    min_node_version?: string;
+    files: Record<string, ManifestFile>;
+}
+/**
+ * Recursively sort all object keys at every depth for deterministic JSON output.
+ * Arrays preserve order; primitives pass through.
+ */
+export declare function canonicalize(obj: unknown): unknown;
+/**
+ * Verify the Ed25519 signature of a remote manifest.
+ * Signs canonical JSON of all fields except `signature`.
+ */
+export declare function verifyManifestSignature(manifest: RemoteManifest, publicKey: string): boolean;
+/**
+ * Compare two semver strings (including prerelease tags). Returns:
+ *   -1 if a < b
+ *    0 if a == b
+ *    1 if a > b
+ *   null if either is not valid semver
+ *
+ * Prerelease ordering follows SemVer 2.0: a version with prerelease has
+ * lower precedence than the same version without prerelease. Prerelease
+ * identifiers are compared lexicographically when both present.
+ */
+export declare function semverCompare(a: string, b: string): number | null;
+//# sourceMappingURL=updater-manifest.d.ts.map

package/dist/updater-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater-manifest.d.ts","sourceRoot":"","sources":["../src/updater-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}