@parall/daemon 1.31.0 → 1.32.0

package/dist/updater-manifest.js

@@ -1,4 +1,4 @@
-import { verify } from "node:crypto";
+import { verify } from 'node:crypto';
 /**
  * Recursively sort all object keys at every depth for deterministic JSON output.
  * Arrays preserve order; primitives pass through.
@@ -6,7 +6,7 @@ import { verify } from "node:crypto";
 export function canonicalize(obj) {
     if (Array.isArray(obj))
         return obj.map(canonicalize);
-    if (obj !== null && typeof obj === "object") {
+    if (obj !== null && typeof obj === 'object') {
         const sorted = {};
         for (const k of Object.keys(obj).sort()) {
             sorted[k] = canonicalize(obj[k]);
@@ -23,7 +23,7 @@ export function verifyManifestSignature(manifest, publicKey) {
     const { signature, ...rest } = manifest;
     const canonical = JSON.stringify(canonicalize(rest));
     try {
-        return verify(null, Buffer.from(canonical), publicKey, Buffer.from(signature, "base64"));
+        return verify(null, Buffer.from(canonical), publicKey, Buffer.from(signature, 'base64'));
     }
     catch {
         return false;
@@ -69,15 +69,15 @@ export function semverCompare(a, b) {
 function parseSemver(v) {
     // Split off prerelease at the first hyphen in the patch component.
     // e.g. "0.0.0-staging.abc1234" → major=0, minor=0, patch="0", pre="staging.abc1234"
-    const parts = v.split(".");
+    const parts = v.split('.');
     if (parts.length < 3)
         return null;
     // Rejoin any dots beyond the first two (prerelease may contain dots)
     const major = Number(parts[0]);
     const minor = Number(parts[1]);
-    const rest = parts.slice(2).join(".");
+    const rest = parts.slice(2).join('.');
     // Split patch from prerelease: "0-staging.abc" → patch="0", pre="staging.abc"
-    const hyphen = rest.indexOf("-");
+    const hyphen = rest.indexOf('-');
     let patchStr;
     let pre;
     if (hyphen >= 0) {

package/dist/updater.d.ts

@@ -1,5 +1,5 @@
-import type { GatewayLogger } from "@parall/agent-core";
-import { type LocalManifest } from "./updater-manifest.js";
+import type { GatewayLogger } from '@parall/agent-core';
+import { type LocalManifest } from './updater-manifest.js';
 export declare class DaemonUpdater {
     private readonly bundleDir;
     private readonly cdnBaseUrl;

package/dist/updater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../src/updater.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,uBAAuB,CAAC;AAoB/B,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAA+B;gBAGjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,EAClB,cAAc,EAAE,OAAO;IAK1C;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C,iBAAiB,IAAI,IAAI;IAOzB;;;OAGG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D;;OAEG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF;;;;OAIG;IACH,aAAa,IAAI,OAAO;IA6CxB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAYtB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAmB1F,QAAQ;IAqGtB,OAAO,CAAC,UAAU;IAmClB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,gBAAgB;IAmBxB,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAUzC,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,OAAO;IA8Bf,OAAO,CAAC,YAAY;IAoCpB,OAAO,CAAC,QAAQ;CAKjB"}
+{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../src/updater.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,uBAAuB,CAAC;AAsB/B,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAA+B;gBAGjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,aAAa,EAClB,cAAc,EAAE,OAAO;IAK1C;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C,iBAAiB,IAAI,IAAI;IAOzB;;;OAGG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D;;OAEG;IACG,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQhF;;;;OAIG;IACH,aAAa,IAAI,OAAO;IA6CxB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAYtB;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;YAuBY,QAAQ;IA4HtB,OAAO,CAAC,UAAU;IAmClB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,gBAAgB;IAmBxB,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAUzC,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,OAAO;IA8Bf,OAAO,CAAC,YAAY;IAoCpB,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/updater.js

@@ -1,14 +1,16 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as https from "node:https";
-import * as http from "node:http";
-import { createHash } from "node:crypto";
-import { verifyManifestSignature, semverCompare, } from "./updater-manifest.js";
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as https from 'node:https';
+import * as http from 'node:http';
+import { createHash } from 'node:crypto';
+import { verifyManifestSignature, semverCompare, } from './updater-manifest.js';
 const UPDATE_EXIT_CODE = 42;
 // Ed25519 public key for verifying daemon bundle manifests.
 // The corresponding private key lives in GitHub Actions secrets (DAEMON_BUNDLE_SIGNING_KEY).
-// Placeholder — replaced with the real key when the CI signing pipeline is set up.
-const SIGNING_PUBLIC_KEY = process.env.PRLL_DAEMON_SIGNING_PUBLIC_KEY ?? "";
+const DEFAULT_SIGNING_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAQHQAZThNX7+deJNyHl/5DgiAa1OHx7UQoJotam0JhUk=
+-----END PUBLIC KEY-----`;
+const SIGNING_PUBLIC_KEY = process.env.PRLL_DAEMON_SIGNING_PUBLIC_KEY || DEFAULT_SIGNING_PUBLIC_KEY;
 export class DaemonUpdater {
     bundleDir;
     cdnBaseUrl;
@@ -89,13 +91,13 @@ export class DaemonUpdater {
             return false;
         if (!state.previous_version)
             return false;
-        const previousDir = path.join(this.bundleDir, "versions", state.previous_version);
+        const previousDir = path.join(this.bundleDir, 'versions', state.previous_version);
         if (!fs.existsSync(previousDir))
             return false;
         this.log.warn(`rollback: ${current.version} failed ${state.boot_count} boots, reverting to ${state.previous_version}`);
-        if (process.platform === "win32") {
+        if (process.platform === 'win32') {
             // Windows: copy previous version files into current dir (no symlinks)
-            const currentDir = path.join(this.bundleDir, "current");
+            const currentDir = path.join(this.bundleDir, 'current');
             if (fs.existsSync(currentDir)) {
                 for (const file of fs.readdirSync(currentDir)) {
                     fs.unlinkSync(path.join(currentDir, file));
@@ -152,7 +154,11 @@ export class DaemonUpdater {
             const current = local?.version;
             if (current) {
                 const cmp = semverCompare(remote.version, current);
-                return { available: cmp !== null && cmp > 0, currentVersion: current, remoteVersion: remote.version };
+                return {
+                    available: cmp !== null && cmp > 0,
+                    currentVersion: current,
+                    remoteVersion: remote.version,
+                };
             }
             return { available: true, remoteVersion: remote.version };
         }
@@ -179,7 +185,7 @@ export class DaemonUpdater {
             remote = JSON.parse(remoteJson);
         }
         catch {
-            this.log.warn("update: failed to parse remote manifest");
+            this.log.warn('update: failed to parse remote manifest');
             return false;
         }
         // Reject same or older versions (downgrade protection)
@@ -197,7 +203,7 @@ export class DaemonUpdater {
         // Verify Ed25519 signature (fail-closed: reject when key is missing)
         if (this.signingEnabled) {
             if (!SIGNING_PUBLIC_KEY) {
-                this.log.error("update: signing enabled but PRLL_DAEMON_SIGNING_PUBLIC_KEY is empty — rejecting update");
+                this.log.error('update: signing enabled but PRLL_DAEMON_SIGNING_PUBLIC_KEY is empty — rejecting update');
                 return false;
             }
             if (!verifyManifestSignature(remote, SIGNING_PUBLIC_KEY)) {
@@ -205,8 +211,20 @@ export class DaemonUpdater {
                 return false;
             }
         }
+        // Check Node.js version compatibility (fail-closed: reject on unparseable versions)
+        if (remote.min_node_version) {
+            const cmp = semverCompare(process.versions.node, remote.min_node_version);
+            if (cmp === null) {
+                this.log.warn(`update: invalid min_node_version "${remote.min_node_version}" in manifest for ${remote.version} — skipping`);
+                return false;
+            }
+            if (cmp < 0) {
+                this.log.warn(`update: ${remote.version} requires Node >= ${remote.min_node_version}, running ${process.versions.node} — skipping`);
+                return false;
+            }
+        }
         // Download all files to staging directory
-        const stagingDir = path.join(this.bundleDir, "staging");
+        const stagingDir = path.join(this.bundleDir, 'staging');
         this.cleanDir(stagingDir);
         fs.mkdirSync(stagingDir, { recursive: true });
         for (const [filename, meta] of Object.entries(remote.files)) {
@@ -222,7 +240,7 @@ export class DaemonUpdater {
             }
             // Verify sha256
             const content = fs.readFileSync(filePath);
-            const hash = createHash("sha256").update(content).digest("hex");
+            const hash = createHash('sha256').update(content).digest('hex');
             if (hash !== meta.sha256) {
                 this.log.error(`update: sha256 mismatch for ${filename} (expected ${meta.sha256}, got ${hash})`);
                 this.cleanDir(stagingDir);
@@ -236,7 +254,7 @@ export class DaemonUpdater {
             }
         }
         // Write manifest to staging
-        fs.writeFileSync(path.join(stagingDir, "manifest.json"), JSON.stringify(remote, null, 2));
+        fs.writeFileSync(path.join(stagingDir, 'manifest.json'), JSON.stringify(remote, null, 2));
         // Atomic swap
         this.atomicSwap(stagingDir, remote.version);
         // Record pending update state
@@ -248,20 +266,20 @@ export class DaemonUpdater {
             boot_count: 0,
         };
         this.saveUpdateState(newState);
-        this.log.info(`update: ${local?.version ?? "unknown"} → ${remote.version} applied, restarting`);
+        this.log.info(`update: ${local?.version ?? 'unknown'} → ${remote.version} applied, restarting`);
         return true;
     }
     atomicSwap(stagingDir, newVersion) {
-        const versionsDir = path.join(this.bundleDir, "versions");
+        const versionsDir = path.join(this.bundleDir, 'versions');
         const targetDir = path.join(versionsDir, newVersion);
-        const currentLink = path.join(this.bundleDir, "current");
+        const currentLink = path.join(this.bundleDir, 'current');
         fs.mkdirSync(versionsDir, { recursive: true });
         // If target version dir already exists (partial previous attempt), remove it
         if (fs.existsSync(targetDir)) {
             fs.rmSync(targetDir, { recursive: true });
         }
         fs.renameSync(stagingDir, targetDir);
-        if (process.platform === "win32") {
+        if (process.platform === 'win32') {
             // Windows: JS files aren't locked, copy directly.
             // Clean old files first to avoid stale artifacts from previous versions.
             const currentDir = currentLink;
@@ -283,7 +301,7 @@ export class DaemonUpdater {
         this.pruneOldVersions(versionsDir, newVersion);
     }
     swapSymlink(version) {
-        const currentLink = path.join(this.bundleDir, "current");
+        const currentLink = path.join(this.bundleDir, 'current');
         const tmpLink = `${currentLink}.new`;
         try {
             fs.unlinkSync(tmpLink);
@@ -312,33 +330,33 @@ export class DaemonUpdater {
     }
     // --- Manifest & State I/O ---
     loadLocalManifest() {
-        const currentDir = path.join(this.bundleDir, "current");
-        const manifestPath = path.join(currentDir, "manifest.json");
+        const currentDir = path.join(this.bundleDir, 'current');
+        const manifestPath = path.join(currentDir, 'manifest.json');
         try {
-            return JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+            return JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
         }
         catch {
             return null;
         }
     }
     loadUpdateState() {
-        const statePath = path.join(this.bundleDir, "update-state.json");
+        const statePath = path.join(this.bundleDir, 'update-state.json');
         try {
-            return JSON.parse(fs.readFileSync(statePath, "utf-8"));
+            return JSON.parse(fs.readFileSync(statePath, 'utf-8'));
         }
         catch {
             return null;
         }
     }
     saveUpdateState(state) {
-        const statePath = path.join(this.bundleDir, "update-state.json");
+        const statePath = path.join(this.bundleDir, 'update-state.json');
         fs.mkdirSync(path.dirname(statePath), { recursive: true });
         fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
     }
     // --- HTTP helpers ---
     httpGet(url, maxRedirects = 5) {
         return new Promise((resolve, reject) => {
-            const mod = url.startsWith("https") ? https : http;
+            const mod = url.startsWith('https') ? https : http;
             const req = mod.get(url, (res) => {
                 if (res.statusCode === 301 || res.statusCode === 302) {
                     if (res.headers.location && maxRedirects > 0) {
@@ -355,11 +373,11 @@ export class DaemonUpdater {
                     return;
                 }
                 const chunks = [];
-                res.on("data", (chunk) => chunks.push(chunk));
-                res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-                res.on("error", reject);
+                res.on('data', (chunk) => chunks.push(chunk));
+                res.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+                res.on('error', reject);
             });
-            req.on("error", reject);
+            req.on('error', reject);
             req.setTimeout(30_000, () => {
                 req.destroy(new Error(`timeout fetching ${url}`));
             });
@@ -367,7 +385,7 @@ export class DaemonUpdater {
     }
     downloadFile(url, dest, maxRedirects = 5) {
         return new Promise((resolve, reject) => {
-            const mod = url.startsWith("https") ? https : http;
+            const mod = url.startsWith('https') ? https : http;
             const req = mod.get(url, (res) => {
                 if (res.statusCode === 301 || res.statusCode === 302) {
                     if (res.headers.location && maxRedirects > 0) {
@@ -385,16 +403,16 @@ export class DaemonUpdater {
                 }
                 const file = fs.createWriteStream(dest);
                 res.pipe(file);
-                file.on("finish", () => {
+                file.on('finish', () => {
                     file.close();
                     resolve();
                 });
-                file.on("error", (err) => {
+                file.on('error', (err) => {
                     fs.unlinkSync(dest);
                     reject(err);
                 });
             });
-            req.on("error", reject);
+            req.on('error', reject);
             req.setTimeout(120_000, () => {
                 req.destroy(new Error(`timeout downloading ${url}`));
             });

package/dist/workspace.d.ts

@@ -1,5 +1,5 @@
-import type { GatewayLogger } from "@parall/agent-core";
-import type { AttachedAgent, ParallClient } from "@parall/sdk";
+import type { GatewayLogger } from '@parall/agent-core';
+import type { AttachedAgent, ParallClient } from '@parall/sdk';
 export interface PrepareWorkspaceOpts {
     client: ParallClient;
     attached: AttachedAgent;

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAA4C,YAAY,EAAE,MAAM,aAAa,CAAC;AAiBzG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,aAAa,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ClF"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EAGb,YAAY,EACb,MAAM,aAAa,CAAC;AAkBrB,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,aAAa,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDlF"}