@parall/daemon 1.32.0 → 1.32.1

package/bundle/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.32.0",
-  "built_at": "2026-06-02T07:49:17.771Z",
+  "version": "1.32.1",
+  "built_at": "2026-06-02T14:24:57.505Z",
   "min_node_version": "20.0.0",
   "files": {
     "package.json": {
@@ -8,21 +8,21 @@
       "size": 18
     },
     "parall-claude-agent.js": {
-      "sha256": "9cdee5c4a66b84c50874904872fc66876cbf27940b0ebab7a5b035e21bd199bd",
-      "size": 1535973
+      "sha256": "eeb0e9458c678d1edc467c0e1d2dc25a0fc5d6d110ab01a5997a2de4fdce776c",
+      "size": 1537100
     },
     "parall-codex-agent.js": {
-      "sha256": "28d849bcbfa158a44c82e46279f52ec83ce63c2f6662843916d810265a09a5b4",
-      "size": 1567062
+      "sha256": "b9af840b8d787d2725540e432b416a489851d01a969b0eb45a0291dec8d70362",
+      "size": 1568189
     },
     "parall-daemon.js": {
-      "sha256": "ab158d832fcb8bcf98389ed146b946c6ee0cf9a4113e6e2290ab20dfd150ba83",
-      "size": 1497242
+      "sha256": "44fcf2c6817a56243bd3391eaf49decd5ce4d8953d0bebb1cfba06a54e5719d7",
+      "size": 1499163
     },
     "parall-openclaw-agent.js": {
       "sha256": "657263cec61e6d26496389ec90ffe0716616a20e082e12c5a17bf6ffd5d1cdd6",
       "size": 9727
     }
   },
-  "signature": "481ZnAOzoLuUOmOgiO3HCPAbyN8uGLYml2wczMsBqpJJS2QWccbuG+e3Zrce93a1mmHlBIiHxrEZXBJMvhDRBg=="
+  "signature": "03XcA+dVTwzforsxVlxsVXHjHJMKJ/yfCHsrddoGTNN7PjK7hdmkT3fRsQqzA3M1hni+7AT++ZGKT4k25Oc6Cg=="
 }

package/bundle/parall-claude-agent.js

@@ -26776,10 +26776,15 @@ Other agents share this workspace. Before starting work, check whether someone
 ### Permissions and approvals
 You have real permissions based on your roles (chat member/admin, org member).
 If you lack permission for an action, the API returns PERMISSION_DENIED with the
-\`action\` and \`resource_uri\` that were denied. When that happens, use
-\`approvals request\` to ask someone with permission to approve it \u2014 don't retry
-or work around the denial. Only request approval after an actual denial, never
-preemptively.
+\`action\` and \`resource_uri\` that were denied. The server decides whether that
+action is approvable: if it is, the CLI prints an \`approvals request\` command \u2014
+fill in the placeholders it shows (\`--chat\`, \`--title\`, \`--reason\`) and run
+it to ask someone with permission. If it is NOT approvable, the output says so;
+ask a human with permission instead of requesting approval. A
+\`INVALID_TARGET\` error instead means you addressed the wrong kind of thing
+(e.g. a \`usr_\` id where a chat is expected) \u2014 follow the message (e.g. use
+\`dm\` for a user). Don't retry or work around a denial; only request approval
+after an actual denial, never preemptively.
 
 ### When in doubt
 Prefer asking over guessing. Prefer "I don't know" over fabricating. Your
@@ -26952,7 +26957,7 @@ See \`docs/engineering-design/agent-dm-loop-prevention.md\` \xA7 Layer 0 for why
 
 When you try an action (e.g., archive a chat) and receive a PERMISSION_DENIED error, you can request someone with permission to do it:
 
-1. The error includes a \`PERMISSION_DENIED\` code. For commonly approvable actions (archive, delete, restore), a \`Tip:\` line with an approval-request template is printed \u2014 copy it and fill in the remaining placeholders (\`--chat\`, \`--title\`, \`--reason\`)
+1. The error includes a \`PERMISSION_DENIED\` code plus the denied \`action\` and \`resource_uri\`. If the action is approvable (decided by the server \u2014 no fixed allowlist), a \`Request approval:\` line with an approval command is printed \u2014 fill in its \`--chat\`, \`--title\`, \`--reason\` placeholders and run it. If it is not approvable, the output says so; ask a human with permission instead.
 2. Request approval: \`parall approvals request --action chat.archive --resource prll://cht_123 --chat prll://cht_456 --title "Archive #old-project" --reason "Channel inactive"\`
 3. A card will appear in the specified chat for someone with permission to approve
 4. Check the result: \`parall approvals get prll://<id>\` or wait: \`parall approvals wait prll://<id> --timeout 300\`
@@ -27548,15 +27553,7 @@ var ParallClient = class _ParallClient {
     }
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     if (res.status === 204)
       return void 0;
@@ -27608,15 +27605,7 @@ var ParallClient = class _ParallClient {
     }
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     if (res.status === 204)
       return void 0;
@@ -28298,15 +28287,7 @@ var ParallClient = class _ParallClient {
       return null;
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     return res.json();
   }
@@ -28772,6 +28753,12 @@ var ApiError = class extends Error {
   status;
   code;
   extras;
+  /** Attempted action (authorization denials) — e.g. "chat.add_member". */
+  action;
+  /** Target resource URI that was evaluated — e.g. "prll://cht_…". */
+  resourceUri;
+  /** Whether the action is approval-executable (PERMISSION_DENIED only). */
+  approvable;
   constructor(status, message, code) {
     super(message);
     this.status = status;
@@ -28779,6 +28766,33 @@ var ApiError = class extends Error {
     this.name = "ApiError";
   }
 };
+function buildApiError(res, rawErrorBody) {
+  const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
+  const errorObj = errorBody.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
+  const errMsg = (typeof errorObj?.message === "string" ? errorObj.message : void 0) ?? (typeof errorBody.message === "string" ? errorBody.message : void 0) ?? (typeof errorBody.error === "string" ? errorBody.error : void 0);
+  const errCode = (typeof errorObj?.code === "string" ? errorObj.code : void 0) ?? (typeof errorBody.code === "string" ? errorBody.code : void 0);
+  const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
+  const anchors = errorObj ?? errorBody;
+  if (typeof anchors.action === "string")
+    apiError.action = anchors.action;
+  if (typeof anchors.resource_uri === "string")
+    apiError.resourceUri = anchors.resource_uri;
+  if (typeof anchors.approvable === "boolean")
+    apiError.approvable = anchors.approvable;
+  const structural = /* @__PURE__ */ new Set(["error", "code", "message", "status"]);
+  const extras = {};
+  for (const [k, v] of Object.entries(errorBody))
+    if (!structural.has(k))
+      extras[k] = v;
+  if (errorObj) {
+    for (const [k, v] of Object.entries(errorObj))
+      if (!structural.has(k))
+        extras[k] = v;
+  }
+  if (Object.keys(extras).length > 0)
+    apiError.extras = extras;
+  return apiError;
+}
 
 // ts/sdk/dist/ws.js
 function isRetryableNetworkError(err) {
@@ -31113,7 +31127,11 @@ parall dm "Alice" --file /tmp/report.pdf --text "Report attached"
 
 ## Approvals
 
-When a CLI command returns a \`PERMISSION_DENIED\` error, the output includes a \`Tip:\` line with an approval-request template \u2014 copy it and fill in the remaining placeholders (\`--chat\`, \`--title\`, \`--reason\`). The \`Tip:\` only appears for commonly approvable actions (archive, delete, restore); for other actions, use \`parall approvals actions\` to check if it's approvable.
+When a CLI command returns a \`PERMISSION_DENIED\` error, the output includes the denied \`action\` and \`resource_uri\`. Whether that action can be approved is decided by the server (there is no fixed allowlist):
+- If it IS approvable, a \`Request approval:\` line with a \`parall approvals request\` command follows \u2014 fill in the placeholders it shows (\`--chat\`, \`--title\`, \`--reason\`) and run it.
+- If it is NOT approvable, the output says so \u2014 ask a human with permission instead of requesting approval.
+
+A different \`INVALID_TARGET\` error means you addressed the wrong kind of thing (e.g. a \`usr_\` id where a chat is expected). Follow the message (e.g. use \`parall dm\` to message a user) \u2014 do not request approval for it.
 
 \`\`\`bash
 # Request approval (use action and resource_uri from the error)
@@ -31155,7 +31173,7 @@ Every entity is addressable with a \`prll://\` URI. Common prefixes you'll see i
 
 When a message or event references \`prll://sch_xxx\` or \`prll://srn_xxx\`, or when you receive \`[Event: schedule.fired]\`, switch to the **parall-schedules** skill for the CLI commands (create / list / pause / resume / cancel / runs).
 
-All CLI output is JSON.
+CLI success output is JSON. Errors print a JSON line (\`{"error","status","code",...}\`) and, on a \`PERMISSION_DENIED\`, may add a plain-text \`Request approval:\` line \u2014 read both.
 `;
 
 // ts/agent-core/dist/skills/parall-tasks.js
@@ -31222,7 +31240,7 @@ When you receive \`[Event: task.comment.created]\`, someone commented on a task
 2. Reply via comment: \`tasks comments add prll://tsk_xxx --body "Response..."\`
 3. If the comment requests status changes, update accordingly
 
-All CLI output is JSON.
+CLI success output is JSON; errors print a JSON line plus, on a \`PERMISSION_DENIED\`, an optional plain-text \`Request approval:\` line \u2014 read both.
 `;
 
 // ts/agent-core/dist/skills/parall-wiki.js
@@ -31355,7 +31373,7 @@ parall wiki reset <slug>      # Restore all files to last synced state
 parall wiki log <slug>        # Recent wiki operations
 \`\`\`
 
-All CLI output is JSON. Run \`parall wiki --help\` for full options.
+CLI success output is JSON; errors may add a plain-text \`Request approval:\` line on a \`PERMISSION_DENIED\` \u2014 read both. Run \`parall wiki --help\` for full options.
 `;
 
 // ts/agent-core/dist/skills/parall-schedules.js

package/bundle/parall-codex-agent.js

@@ -26776,10 +26776,15 @@ Other agents share this workspace. Before starting work, check whether someone
 ### Permissions and approvals
 You have real permissions based on your roles (chat member/admin, org member).
 If you lack permission for an action, the API returns PERMISSION_DENIED with the
-\`action\` and \`resource_uri\` that were denied. When that happens, use
-\`approvals request\` to ask someone with permission to approve it \u2014 don't retry
-or work around the denial. Only request approval after an actual denial, never
-preemptively.
+\`action\` and \`resource_uri\` that were denied. The server decides whether that
+action is approvable: if it is, the CLI prints an \`approvals request\` command \u2014
+fill in the placeholders it shows (\`--chat\`, \`--title\`, \`--reason\`) and run
+it to ask someone with permission. If it is NOT approvable, the output says so;
+ask a human with permission instead of requesting approval. A
+\`INVALID_TARGET\` error instead means you addressed the wrong kind of thing
+(e.g. a \`usr_\` id where a chat is expected) \u2014 follow the message (e.g. use
+\`dm\` for a user). Don't retry or work around a denial; only request approval
+after an actual denial, never preemptively.
 
 ### When in doubt
 Prefer asking over guessing. Prefer "I don't know" over fabricating. Your
@@ -26952,7 +26957,7 @@ See \`docs/engineering-design/agent-dm-loop-prevention.md\` \xA7 Layer 0 for why
 
 When you try an action (e.g., archive a chat) and receive a PERMISSION_DENIED error, you can request someone with permission to do it:
 
-1. The error includes a \`PERMISSION_DENIED\` code. For commonly approvable actions (archive, delete, restore), a \`Tip:\` line with an approval-request template is printed \u2014 copy it and fill in the remaining placeholders (\`--chat\`, \`--title\`, \`--reason\`)
+1. The error includes a \`PERMISSION_DENIED\` code plus the denied \`action\` and \`resource_uri\`. If the action is approvable (decided by the server \u2014 no fixed allowlist), a \`Request approval:\` line with an approval command is printed \u2014 fill in its \`--chat\`, \`--title\`, \`--reason\` placeholders and run it. If it is not approvable, the output says so; ask a human with permission instead.
 2. Request approval: \`parall approvals request --action chat.archive --resource prll://cht_123 --chat prll://cht_456 --title "Archive #old-project" --reason "Channel inactive"\`
 3. A card will appear in the specified chat for someone with permission to approve
 4. Check the result: \`parall approvals get prll://<id>\` or wait: \`parall approvals wait prll://<id> --timeout 300\`
@@ -27548,15 +27553,7 @@ var ParallClient = class _ParallClient {
     }
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     if (res.status === 204)
       return void 0;
@@ -27608,15 +27605,7 @@ var ParallClient = class _ParallClient {
     }
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     if (res.status === 204)
       return void 0;
@@ -28298,15 +28287,7 @@ var ParallClient = class _ParallClient {
       return null;
     if (!res.ok) {
       const rawErrorBody = await res.json().catch(() => ({}));
-      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
-      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
-      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
-      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
-      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
-      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
-      if (Object.keys(extras).length > 0)
-        apiError.extras = extras;
-      throw apiError;
+      throw buildApiError(res, rawErrorBody);
     }
     return res.json();
   }
@@ -28772,6 +28753,12 @@ var ApiError = class extends Error {
   status;
   code;
   extras;
+  /** Attempted action (authorization denials) — e.g. "chat.add_member". */
+  action;
+  /** Target resource URI that was evaluated — e.g. "prll://cht_…". */
+  resourceUri;
+  /** Whether the action is approval-executable (PERMISSION_DENIED only). */
+  approvable;
   constructor(status, message, code) {
     super(message);
     this.status = status;
@@ -28779,6 +28766,33 @@ var ApiError = class extends Error {
     this.name = "ApiError";
   }
 };
+function buildApiError(res, rawErrorBody) {
+  const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
+  const errorObj = errorBody.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
+  const errMsg = (typeof errorObj?.message === "string" ? errorObj.message : void 0) ?? (typeof errorBody.message === "string" ? errorBody.message : void 0) ?? (typeof errorBody.error === "string" ? errorBody.error : void 0);
+  const errCode = (typeof errorObj?.code === "string" ? errorObj.code : void 0) ?? (typeof errorBody.code === "string" ? errorBody.code : void 0);
+  const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
+  const anchors = errorObj ?? errorBody;
+  if (typeof anchors.action === "string")
+    apiError.action = anchors.action;
+  if (typeof anchors.resource_uri === "string")
+    apiError.resourceUri = anchors.resource_uri;
+  if (typeof anchors.approvable === "boolean")
+    apiError.approvable = anchors.approvable;
+  const structural = /* @__PURE__ */ new Set(["error", "code", "message", "status"]);
+  const extras = {};
+  for (const [k, v] of Object.entries(errorBody))
+    if (!structural.has(k))
+      extras[k] = v;
+  if (errorObj) {
+    for (const [k, v] of Object.entries(errorObj))
+      if (!structural.has(k))
+        extras[k] = v;
+  }
+  if (Object.keys(extras).length > 0)
+    apiError.extras = extras;
+  return apiError;
+}
 
 // ts/sdk/dist/ws.js
 function isRetryableNetworkError(err) {
@@ -31113,7 +31127,11 @@ parall dm "Alice" --file /tmp/report.pdf --text "Report attached"
 
 ## Approvals
 
-When a CLI command returns a \`PERMISSION_DENIED\` error, the output includes a \`Tip:\` line with an approval-request template \u2014 copy it and fill in the remaining placeholders (\`--chat\`, \`--title\`, \`--reason\`). The \`Tip:\` only appears for commonly approvable actions (archive, delete, restore); for other actions, use \`parall approvals actions\` to check if it's approvable.
+When a CLI command returns a \`PERMISSION_DENIED\` error, the output includes the denied \`action\` and \`resource_uri\`. Whether that action can be approved is decided by the server (there is no fixed allowlist):
+- If it IS approvable, a \`Request approval:\` line with a \`parall approvals request\` command follows \u2014 fill in the placeholders it shows (\`--chat\`, \`--title\`, \`--reason\`) and run it.
+- If it is NOT approvable, the output says so \u2014 ask a human with permission instead of requesting approval.
+
+A different \`INVALID_TARGET\` error means you addressed the wrong kind of thing (e.g. a \`usr_\` id where a chat is expected). Follow the message (e.g. use \`parall dm\` to message a user) \u2014 do not request approval for it.
 
 \`\`\`bash
 # Request approval (use action and resource_uri from the error)
@@ -31155,7 +31173,7 @@ Every entity is addressable with a \`prll://\` URI. Common prefixes you'll see i
 
 When a message or event references \`prll://sch_xxx\` or \`prll://srn_xxx\`, or when you receive \`[Event: schedule.fired]\`, switch to the **parall-schedules** skill for the CLI commands (create / list / pause / resume / cancel / runs).
 
-All CLI output is JSON.
+CLI success output is JSON. Errors print a JSON line (\`{"error","status","code",...}\`) and, on a \`PERMISSION_DENIED\`, may add a plain-text \`Request approval:\` line \u2014 read both.
 `;
 
 // ts/agent-core/dist/skills/parall-tasks.js
@@ -31222,7 +31240,7 @@ When you receive \`[Event: task.comment.created]\`, someone commented on a task
 2. Reply via comment: \`tasks comments add prll://tsk_xxx --body "Response..."\`
 3. If the comment requests status changes, update accordingly
 
-All CLI output is JSON.
+CLI success output is JSON; errors print a JSON line plus, on a \`PERMISSION_DENIED\`, an optional plain-text \`Request approval:\` line \u2014 read both.
 `;
 
 // ts/agent-core/dist/skills/parall-wiki.js
@@ -31355,7 +31373,7 @@ parall wiki reset <slug>      # Restore all files to last synced state
 parall wiki log <slug>        # Recent wiki operations
 \`\`\`
 
-All CLI output is JSON. Run \`parall wiki --help\` for full options.
+CLI success output is JSON; errors may add a plain-text \`Request approval:\` line on a \`PERMISSION_DENIED\` \u2014 read both. Run \`parall wiki --help\` for full options.
 `;
 
 // ts/agent-core/dist/skills/parall-schedules.js