@parall/daemon 1.32.0 → 1.33.0

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AA2BF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA0DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI5E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA0DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}

package/dist/config.js

@@ -24,7 +24,19 @@ function parseMsAllowZero(value, fallback) {
     const n = Number(value);
     return Number.isFinite(n) && n >= 0 ? n : fallback;
 }
+/**
+ * Root dir for all on-disk daemon state: `config.json`, the self-update
+ * `bundle/` overlay (versions + current symlink + update-state.json), and
+ * bridge-bin resolution all derive from this single path. `PRLL_DAEMON_CONFIG_DIR`
+ * overrides it so multiple daemons can coexist on one host without colliding —
+ * e.g. a staging desktop install points its launchd agent at
+ * `~/.parall-daemon-staging` while prod keeps the default `~/.parall-daemon`.
+ * Unset → default (no behavior change for existing single-env installs).
+ */
 export function daemonConfigDir(env = process.env) {
+    const override = env.PRLL_DAEMON_CONFIG_DIR?.trim();
+    if (override)
+        return resolvePath(override);
     return path.join(env.HOME || os.homedir(), '.parall-daemon');
 }
 export function daemonConfigPath(env = process.env) {

package/dist/index.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
+import * as path from 'node:path';
 import { createLogger, createOtelLogger, initAgentTelemetry, } from '@parall/agent-core';
 import { ParallClient } from '@parall/sdk';
-import { resolveClaudeDaemonConfig, resolveBundleDir, resolveWsUrl, } from './config.js';
+import { runCLI } from './cli.js';
+import { resolveBundleDir, resolveClaudeDaemonConfig, resolveWsUrl, } from './config.js';
 import { DaemonSupervisor, sleepCancellable } from './supervisor.js';
 import { DaemonUpdater } from './updater.js';
-import { runCLI } from './cli.js';
 const UPDATE_EXIT_CODE = 42;
 let log = createLogger('daemon');
 function formatError(reason) {
@@ -13,6 +14,39 @@ function formatError(reason) {
     }
     return String(reason);
 }
+/**
+ * Self-update should run only when a service manager supervises the daemon —
+ * `parall-daemon service install` (launchd/systemd) or the hosted entrypoint.sh
+ * keepalive loop. Those wrappers re-exec the overlay bundle on restart, and
+ * exit(UPDATE_EXIT_CODE) is precisely what triggers that restart so the new code
+ * loads.
+ *
+ * A bare `npx @parall/daemon` foreground run has neither property: it never
+ * exec's the overlay (so a downloaded bundle is dead weight on disk — this very
+ * process keeps running the npm launcher code), and nothing restarts it after
+ * exit(42). Self-updating there would just kill the daemon with no recovery. So
+ * we gate on two positive "managed" signals:
+ *   - PRLL_DAEMON_MANAGED=1 — injected into the plist / systemd unit by
+ *     `service install`; the authoritative marker.
+ *   - launched from the overlay bundle dir — a service wrapper already exec'd
+ *     `…/.parall-daemon/bundle/current/parall-daemon.js`. Covers service
+ *     installs predating the PRLL_DAEMON_MANAGED marker.
+ * Foreground users stay current via `npx @parall/daemon@latest`, which pulls the
+ * newest launcher on every run.
+ */
+function isSelfUpdateManaged(env, bundleDir) {
+    if (env.PRLL_DAEMON_MANAGED === '1' || env.PRLL_DAEMON_MANAGED === 'true')
+        return true;
+    const entry = process.argv[1];
+    if (entry) {
+        const resolvedEntry = path.resolve(entry);
+        const resolvedBundle = path.resolve(bundleDir);
+        if (resolvedEntry === resolvedBundle || resolvedEntry.startsWith(resolvedBundle + path.sep)) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Outer keepalive: runs `supervisor.run()` in a loop, restarting it with
  * exponential backoff if it rejects. The daemon process only exits when
@@ -61,7 +95,7 @@ async function runForever(config, client, log, signal, updater) {
                 log.error('supervisor keepalive disabled (PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS=0) — exiting');
                 throw err;
             }
-            const delay = Math.min(config.supervisorRestartBackoffMs * Math.pow(2, attempt), config.supervisorRestartBackoffMaxMs);
+            const delay = Math.min(config.supervisorRestartBackoffMs * 2 ** attempt, config.supervisorRestartBackoffMaxMs);
             attempt += 1;
             log.warn(`restarting supervisor in ${delay}ms (attempt ${attempt})`);
             const slept = await sleepCancellable(delay, signal);
@@ -77,9 +111,13 @@ async function main() {
     log.info(`boot: api=${config.apiUrl} pollMs=${config.pollIntervalMs} heartbeatMs=${config.heartbeatIntervalMs} agentBin=${config.agentBin}`);
     log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
     // --- Self-update: rollback check (before any network calls) ---
+    // Only run when a service manager supervises us (see isSelfUpdateManaged):
+    // a bare `npx` foreground run can't load the overlay and won't be restarted
+    // after exit(42), so self-update there would just kill the daemon.
     let updater = null;
-    if (!config.updateDisabled) {
-        const bundleDir = resolveBundleDir(process.env);
+    const bundleDir = resolveBundleDir(process.env);
+    const selfUpdateEnabled = !config.updateDisabled && isSelfUpdateManaged(process.env, bundleDir);
+    if (selfUpdateEnabled) {
         updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, log, true);
         if (updater.checkRollback()) {
             log.info('rollback applied — exiting for service manager restart');
@@ -88,6 +126,9 @@ async function main() {
         }
         log.info(`update: bundleDir=${bundleDir} cdn=${config.updateCdnUrl} interval=${config.updateIntervalMs}ms`);
     }
+    else if (!config.updateDisabled) {
+        log.info('update: skipped (foreground mode) — run `parall-daemon service install` for managed auto-update');
+    }
     // The daemon talks to the API as a Machine — the bearer is mck_*.
     // No orgId is configured here; per-agent subprocesses get their
     // own org_id via the spawn env.

package/dist/runtime-bin-resolver.d.ts

@@ -0,0 +1,7 @@
+type RuntimeBinLogger = {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+};
+export declare function applyRuntimeBinaryEnv(runtimeType: string, baseEnv: NodeJS.ProcessEnv, log: RuntimeBinLogger): NodeJS.ProcessEnv;
+export {};
+//# sourceMappingURL=runtime-bin-resolver.d.ts.map

package/dist/runtime-bin-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-bin-resolver.d.ts","sourceRoot":"","sources":["../src/runtime-bin-resolver.ts"],"names":[],"mappings":"AAUA,KAAK,gBAAgB,GAAG;IACtB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AA0BF,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,GAAG,EAAE,gBAAgB,GACpB,MAAM,CAAC,UAAU,CAmCnB"}

package/dist/runtime-bin-resolver.js

@@ -0,0 +1,292 @@
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const RUNTIME_BINARIES = {
+    'claude-code': { command: 'claude', envVar: 'PRLL_CLAUDE_BIN' },
+    codex: { command: 'codex', envVar: 'PRLL_CODEX_BIN' },
+    openclaw: { command: 'openclaw', envVar: 'PRLL_OPENCLAW_BIN' },
+};
+const RESOLUTION_CACHE_TTL_MS = 5 * 60_000;
+const resolutionCache = new Map();
+export function applyRuntimeBinaryEnv(runtimeType, baseEnv, log) {
+    const env = { ...baseEnv };
+    const originalPath = env.PATH;
+    const pathPlan = candidatePathPlan(env);
+    const primaryPath = mergePath(pathPlan.primaryDirs, originalPath);
+    env.PATH = mergePath([...pathPlan.primaryDirs, ...pathPlan.versionedFallbackDirs], originalPath);
+    const spec = RUNTIME_BINARIES[runtimeType];
+    if (!spec)
+        return env;
+    const configured = env[spec.envVar]?.trim();
+    if (configured) {
+        const resolved = resolveRuntimeCommand(configured, env, originalPath, primaryPath, env.PATH);
+        if (resolved) {
+            env[spec.envVar] = resolved.binaryPath;
+            env.PATH = anchorResolvedPath(env.PATH, resolved);
+            log.info(`runtime ${runtimeType}: using ${spec.envVar}=${resolved.binaryPath}`);
+        }
+        else {
+            log.warn(`runtime ${runtimeType}: configured ${spec.envVar}=${configured} is not executable`);
+        }
+        return env;
+    }
+    const resolved = resolveRuntimeCommand(spec.command, env, originalPath, primaryPath, env.PATH);
+    if (resolved) {
+        env[spec.envVar] = resolved.binaryPath;
+        env.PATH = anchorResolvedPath(env.PATH, resolved);
+        log.info(`runtime ${runtimeType}: resolved ${spec.command} at ${resolved.binaryPath}`);
+    }
+    else {
+        log.warn(`runtime ${runtimeType}: could not resolve ${spec.command}; child will rely on PATH ` +
+            `(${env.PATH ?? '<empty>'})`);
+    }
+    return env;
+}
+function resolveRuntimeCommand(command, env, inheritedPath, primaryPath, fallbackPath) {
+    const cacheKey = `runtime\0${command}\0${primaryPath}\0${fallbackPath}\0${env.SHELL ?? ''}\0${env.HOME ?? ''}`;
+    const cached = getCachedResolution(cacheKey);
+    if (cached)
+        return cached;
+    const direct = resolveDirectPath(command);
+    if (direct) {
+        const resolved = { binaryPath: direct };
+        setCachedResolution(cacheKey, resolved);
+        return resolved;
+    }
+    const fromInheritedPath = resolveFromPath(command, inheritedPath, env);
+    if (fromInheritedPath) {
+        setCachedResolution(cacheKey, fromInheritedPath);
+        return fromInheritedPath;
+    }
+    const fromShell = resolveFromLoginShell(command, { ...env, PATH: inheritedPath });
+    if (fromShell) {
+        setCachedResolution(cacheKey, fromShell);
+        return fromShell;
+    }
+    const fromPrimaryPath = resolveFromPath(command, primaryPath, env);
+    if (fromPrimaryPath) {
+        setCachedResolution(cacheKey, fromPrimaryPath);
+        return fromPrimaryPath;
+    }
+    const fromFallbackPath = fallbackPath === primaryPath ? null : resolveFromPath(command, fallbackPath, env);
+    if (fromFallbackPath) {
+        setCachedResolution(cacheKey, fromFallbackPath);
+        return fromFallbackPath;
+    }
+    return null;
+}
+function resolveDirectPath(command) {
+    if (!command.includes('/') && !command.includes('\\'))
+        return null;
+    const abs = path.isAbsolute(command) ? command : path.resolve(process.cwd(), command);
+    return isExecutable(abs) ? abs : null;
+}
+function resolveFromPath(command, pathValue, env) {
+    if (!pathValue || command.includes('/') || command.includes('\\'))
+        return null;
+    const dirs = pathValue.split(path.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        for (const file of commandCandidates(command, env)) {
+            const candidate = path.join(dir, file);
+            if (isExecutable(candidate))
+                return { binaryPath: candidate, pathValue };
+        }
+    }
+    return null;
+}
+function resolveFromLoginShell(command, env) {
+    if (command.includes('/') || command.includes('\\'))
+        return null;
+    const shells = unique([
+        env.SHELL?.trim(),
+        process.platform === 'darwin' ? '/bin/zsh' : undefined,
+        '/bin/bash',
+        '/bin/sh',
+    ]);
+    for (const shell of shells) {
+        if (!shell || !isExecutable(shell))
+            continue;
+        try {
+            const out = execFileSync(shell, [
+                '-lic',
+                `resolved=$(command -v ${shellQuote(command)}) || exit $?; printf '__PRLL_BIN__%s\n__PRLL_PATH__%s\n' "$resolved" "$PATH"`,
+            ], {
+                encoding: 'utf8',
+                env,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 2_500,
+            });
+            let binaryPath = '';
+            let pathValue = '';
+            for (const line of out.split(/\r?\n/)) {
+                if (line.startsWith('__PRLL_BIN__'))
+                    binaryPath = line.slice('__PRLL_BIN__'.length).trim();
+                if (line.startsWith('__PRLL_PATH__'))
+                    pathValue = line.slice('__PRLL_PATH__'.length);
+            }
+            if (path.isAbsolute(binaryPath) && isExecutable(binaryPath)) {
+                return { binaryPath, pathValue: pathValue || undefined };
+            }
+        }
+        catch {
+            // Shell startup files may be noisy or slow. Keep resolution best-effort.
+        }
+    }
+    return null;
+}
+function candidatePathPlan(env) {
+    const home = env.HOME || os.homedir();
+    const primaryDirs = [
+        ...splitPath(env.PRLL_DAEMON_RUNTIME_PATH),
+        ...splitPath(env.PRLL_DAEMON_EXTRA_PATH),
+        path.dirname(process.execPath),
+        path.join(path.dirname(process.execPath), 'bin'),
+        path.resolve(path.dirname(process.execPath), '..', 'Resources', 'bin'),
+        path.join(home, '.local', 'bin'),
+        path.join(home, 'bin'),
+        path.join(home, '.npm-global', 'bin'),
+        path.join(home, 'Library', 'pnpm'),
+        path.join(home, '.local', 'share', 'pnpm'),
+        path.join(home, '.volta', 'bin'),
+        path.join(home, '.bun', 'bin'),
+        path.join(home, '.asdf', 'shims'),
+        path.join(home, '.local', 'share', 'mise', 'shims'),
+        path.join(home, '.mise', 'shims'),
+        path.join(home, '.fnm', 'aliases', 'default', 'bin'),
+        path.join(home, 'Library', 'Application Support', 'fnm', 'aliases', 'default', 'bin'),
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+        '/usr/bin',
+        '/bin',
+        '/usr/sbin',
+        '/sbin',
+        '/snap/bin',
+    ];
+    const versionedFallbackDirs = [
+        ...nvmVersionBinDirs(home),
+        ...fnmVersionBinDirs(home),
+    ];
+    return {
+        primaryDirs: unique(primaryDirs).filter((dir) => !!dir && isDirectory(dir)),
+        versionedFallbackDirs: unique(versionedFallbackDirs).filter((dir) => !!dir && isDirectory(dir)),
+    };
+}
+function nvmVersionBinDirs(home) {
+    const root = path.join(home, '.nvm', 'versions', 'node');
+    let versions;
+    try {
+        versions = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    return sortVersionNamesDesc(versions).map((version) => path.join(root, version, 'bin'));
+}
+function fnmVersionBinDirs(home) {
+    const roots = [
+        path.join(home, '.fnm', 'node-versions'),
+        path.join(home, 'Library', 'Application Support', 'fnm', 'node-versions'),
+    ];
+    const dirs = [];
+    for (const root of roots) {
+        let versions;
+        try {
+            versions = fs.readdirSync(root);
+        }
+        catch {
+            continue;
+        }
+        dirs.push(...sortVersionNamesDesc(versions).map((version) => path.join(root, version, 'installation', 'bin')));
+    }
+    return dirs;
+}
+function sortVersionNamesDesc(values) {
+    return [...values].sort((a, b) => compareVersionName(b, a));
+}
+function compareVersionName(a, b) {
+    const av = parseVersionName(a);
+    const bv = parseVersionName(b);
+    const max = Math.max(av.length, bv.length);
+    for (let i = 0; i < max; i += 1) {
+        const diff = (av[i] ?? 0) - (bv[i] ?? 0);
+        if (diff !== 0)
+            return diff;
+    }
+    return a.localeCompare(b);
+}
+function parseVersionName(value) {
+    return value
+        .replace(/^v/i, '')
+        .split('.')
+        .map((part) => Number.parseInt(part, 10))
+        .filter((part) => Number.isFinite(part));
+}
+function splitPath(value) {
+    return value?.split(path.delimiter).filter(Boolean) ?? [];
+}
+function mergePath(prependDirs, existing) {
+    return unique([...prependDirs, ...splitPath(existing)]).join(path.delimiter);
+}
+function anchorResolvedPath(pathValue, resolution) {
+    return mergePath([path.dirname(resolution.binaryPath), ...splitPath(resolution.pathValue)], pathValue);
+}
+function commandCandidates(command, env) {
+    if (process.platform !== 'win32')
+        return [command];
+    const hasExt = /\.[^\\/]+$/.test(command);
+    if (hasExt)
+        return [command];
+    const exts = (env.PATHEXT || '.EXE;.CMD;.BAT;.COM')
+        .split(';')
+        .filter(Boolean)
+        .map((ext) => ext.toLowerCase());
+    return [command, ...exts.map((ext) => `${command}${ext}`)];
+}
+function getCachedResolution(cacheKey) {
+    const entry = resolutionCache.get(cacheKey);
+    if (!entry)
+        return null;
+    if (entry.expiresAt <= Date.now()) {
+        resolutionCache.delete(cacheKey);
+        return null;
+    }
+    return entry.value;
+}
+function setCachedResolution(cacheKey, value) {
+    resolutionCache.set(cacheKey, { value, expiresAt: Date.now() + RESOLUTION_CACHE_TTL_MS });
+}
+function isExecutable(file) {
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile())
+            return false;
+        fs.accessSync(file, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isDirectory(dir) {
+    try {
+        return fs.statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function unique(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        if (!value || seen.has(value))
+            continue;
+        seen.add(value);
+        out.push(value);
+    }
+    return out;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}

package/dist/supervisor.d.ts

@@ -1,7 +1,7 @@
 import { type GatewayLogger } from '@parall/agent-core';
-import { ParallClient } from '@parall/sdk';
-import type { DaemonUpdater } from './updater.js';
+import { type ParallClient } from '@parall/sdk';
 import { type ClaudeDaemonConfig } from './config.js';
+import type { DaemonUpdater } from './updater.js';
 /**
  * Sleep that wakes early on abort. Returns true if the full delay elapsed,
  * false if aborted. Used by bootstrap retry and the outer keepalive in
@@ -27,6 +27,7 @@ export declare class DaemonSupervisor {
     private readonly children;
     private readonly spawningAgents;
     private readonly pendingWorkspaceSetup;
+    private readonly browserProfileLifecycleQueues;
     private readonly workspaceSetupRetryTimers;
     private readonly cancelledSpawns;
     private ws;
@@ -34,11 +35,19 @@ export declare class DaemonSupervisor {
     private machineId;
     private machineOrgId;
     private machineLlmSource;
+    private machineProviderEnabled;
+    private machineClipProviderUrl;
+    private connectedClipServiceUrl;
     private stopResolve;
     private updater;
     private healthConfirmed;
+    private browserProfileManager;
     private clipManager;
     private clipProvider;
+    private clipReconcileTimer;
+    private clipReconcileInFlight;
+    private hubClient;
+    private hubClientUrl;
     constructor(config: ClaudeDaemonConfig, client: ParallClient, log: GatewayLogger);
     setUpdater(updater: DaemonUpdater): void;
     /** Start the supervisor. Returns a promise that resolves on `stop()`. */
@@ -47,6 +56,7 @@ export declare class DaemonSupervisor {
     stop(): Promise<void>;
     private bootstrapWithRetry;
     private fullReconcile;
+    private reconcileBrowserProfiles;
     /**
      * Detects a legacy flat state layout (no agents/ subdir) and migrates it
      * into the per-agent directory for the owning agent. Ownership is determined
@@ -57,12 +67,51 @@ export declare class DaemonSupervisor {
     private handleAgentAttached;
     private handleAgentDetached;
     private handleFilesystemBrowse;
-    private handleClipInstall;
-    private reconcileClipInstalls;
+    private handleBrowserProfileLifecycle;
+    private enqueueBrowserProfileLifecycle;
+    private handleClipSync;
+    private reconcileMachineClips;
+    private reconcileMachineClipsNow;
+    private startClipReconcileTimer;
+    private stopClipReconcileTimer;
+    private machineClipToConfig;
+    private manifestFromMachineClip;
+    private dependencyMap;
+    private clipConfigSignature;
+    private ensureClipInstalled;
+    private readInstalledClipVersion;
+    private reconnectClipProvider;
     private handleWorkspaceSetupRequested;
     private scheduleWorkspaceSetupRetry;
     private clearWorkspaceSetupRetry;
     private refreshMachineConfig;
+    /**
+     * Resolve the ProviderStream endpoint the daemon registers clips against.
+     * Priority: PRLL_CLIP_SERVICE_URL (hosted/cluster DNS or explicit operator
+     * override) > machine.clip_provider_url (server-delivered grey-cloud
+     * clip-rpc host for BYOC) > config.apiUrl (legacy fallback for servers
+     * predating clip_provider_url). The grey-cloud host bypasses Cloudflare's
+     * proxy, which does not pass Connect-RPC bidi streams (#1430).
+     */
+    private resolveClipServiceUrl;
+    /**
+     * Execution-side hub client used to resolve a Clip's dependency
+     * binding (GetBindings) and forward the dependency invoke (Invoke). It targets
+     * the same grey-cloud clip-rpc endpoint as the provider stream and auths with
+     * the daemon's mck_ (the hub scope-gates calls to instances this machine
+     * executes). Rebuilt transparently when the resolved endpoint changes.
+     */
+    private getHubClient;
+    /**
+     * Connect, reconnect, or disconnect the clip Provider to match
+     * machineProviderEnabled and the resolved ProviderStream endpoint. An org
+     * admin toggles provider_enabled to withdraw the machine from the org clip
+     * provider pool without uninstalling clips; a changed clip_provider_url
+     * triggers a transparent reconnect to the new endpoint. No-op when the clip
+     * runtime is disabled or identity is not yet resolved. See
+     * docs/engineering-design/clip-provider-sharing-design.md.
+     */
+    private applyClipProviderState;
     private respawnAllChildren;
     private restartChildNow;
     private spawnAgent;

package/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,YAAY,EAab,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,KAAK,kBAAkB,EAMxB,MAAM,aAAa,CAAC;AAmBrB;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAkBzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAnBtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,YAAY,CAA6B;gBAG9B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA+J7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAyCb,kBAAkB;YAsClB,aAAa;IA2D3B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,sBAAsB;YAwBtB,iBAAiB;YAmEjB,qBAAqB;YAqBrB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;YAgBpB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IAkE5B,OAAO,CAAC,UAAU;YA2GJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CAkCnC"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAcL,KAAK,YAAY,EAElB,MAAM,aAAa,CAAC;AASrB,OAAO,EAKL,KAAK,kBAAkB,EAExB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAiBlD;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAqCzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAtCtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAoC;IAClF,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAG5C,OAAO,CAAC,sBAAsB,CAAQ;IAItC,OAAO,CAAC,sBAAsB,CAAuB;IAGrD,OAAO,CAAC,uBAAuB,CAAuB;IACtD,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAI3D,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,YAAY,CAAuB;gBAGxB,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAmL7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Cb,kBAAkB;YAwClB,aAAa;YA0Db,wBAAwB;IA+BtC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAmBnB,sBAAsB;YAwBtB,6BAA6B;IAoC3C,OAAO,CAAC,8BAA8B;YAgBxB,cAAc;YAId,qBAAqB;YAgBrB,wBAAwB;IA+CtC,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,mBAAmB;YAab,mBAAmB;IAyCjC,OAAO,CAAC,wBAAwB;YAelB,qBAAqB;YAWrB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;IAmClC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;;;OAQG;YACW,sBAAsB;YA4CtB,kBAAkB;YAYlB,eAAe;YAcf,UAAU;YAoBV,cAAc;IAkE5B,OAAO,CAAC,UAAU;YA4GJ,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CAkCnC"}