@parall/daemon 1.35.0 → 1.36.1

package/bundle/parall-daemon.js

@@ -27256,6 +27256,17 @@ var ENDPOINTS = {
   SCHEDULE_CANCEL: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/cancel`,
   SCHEDULE_RUNS: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/runs`,
   SCHEDULE_RUN: (orgId, runId) => `${API_BASE}/orgs/${orgId}/schedule_runs/${runId}`,
+  // External triggers (org-scoped incoming integration primitive)
+  EXTERNAL_CONNECTIONS: (orgId) => `${API_BASE}/orgs/${orgId}/external-connections`,
+  EXTERNAL_CONNECTION: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/external-connections/${connectionId}`,
+  EXTERNAL_CONNECTION_INGRESS_TOKEN_REGENERATE: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/external-connections/${connectionId}/ingress-token/regenerate`,
+  EXTERNAL_TRIGGER_SCHEMA: (orgId, connectionId) => `${API_BASE}/orgs/${orgId}/external-connections/${connectionId}/trigger-schema`,
+  EXTERNAL_INGRESS_EVENTS: (orgId) => `${API_BASE}/orgs/${orgId}/external-ingress-events`,
+  EXTERNAL_INGRESS_EVENT: (orgId, eventId) => `${API_BASE}/orgs/${orgId}/external-ingress-events/${eventId}`,
+  EXTERNAL_TRIGGERS: (orgId) => `${API_BASE}/orgs/${orgId}/external-triggers`,
+  EXTERNAL_TRIGGER: (orgId, triggerId) => `${API_BASE}/orgs/${orgId}/external-triggers/${triggerId}`,
+  EXTERNAL_TRIGGER_RUNS: (orgId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs`,
+  EXTERNAL_TRIGGER_RUN: (orgId, runId) => `${API_BASE}/orgs/${orgId}/external-trigger-runs/${runId}`,
   // Invitations (org-scoped, admin)
   ORG_INVITATIONS: (orgId) => `${API_BASE}/orgs/${orgId}/invitations`,
   ORG_INVITATION: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}`,
@@ -27337,6 +27348,7 @@ var ENDPOINTS = {
   // References (org-scoped)
   REFS_RESOLVE: (orgId) => `${API_BASE}/orgs/${orgId}/refs/resolve`,
   REFS_BACKLINKS: (orgId) => `${API_BASE}/orgs/${orgId}/refs/backlinks`,
+  REFS_GRAPH: (orgId) => `${API_BASE}/orgs/${orgId}/refs/graph`,
   REFS_CHECK: (orgId) => `${API_BASE}/orgs/${orgId}/refs/check`,
   // Platform config (agent-scoped, not org-scoped)
   PLATFORM_CONFIG: `${API_BASE}/agents/platform-config`,
@@ -27465,6 +27477,7 @@ var WS_EVENTS = {
 // ts/sdk/dist/client.js
 var ParallClient = class _ParallClient {
   baseUrl;
+  wikiBaseUrl;
   token;
   onTokenExpired;
   getRefreshToken;
@@ -27516,12 +27529,22 @@ var ParallClient = class _ParallClient {
   }
   constructor(options = {}) {
     this.baseUrl = options.baseUrl ?? "";
+    this.wikiBaseUrl = options.wikiBaseUrl ?? this.baseUrl;
     this.token = options.token ?? null;
     this.onTokenExpired = options.onTokenExpired;
     this.getRefreshToken = options.getRefreshToken;
     this.setTokens = options.setTokens;
     this.swimlaneName = options.swimlaneName;
   }
+  /**
+   * Pick the origin for a request path: wiki-service base for `/wiki/v1`
+   * endpoints, api base for everything else. The path itself (from ENDPOINTS)
+   * is authoritative, so wiki vs api routing can't drift from how a caller
+   * happens to invoke the client.
+   */
+  baseUrlFor(path15) {
+    return path15.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
+  }
   setToken(token) {
     this.token = token;
   }
@@ -27586,7 +27609,7 @@ var ParallClient = class _ParallClient {
     if (!retried) {
       await this.ensureFreshToken(path15);
     }
-    let url = `${this.baseUrl}${path15}`;
+    let url = `${this.baseUrlFor(path15)}${path15}`;
     if (query) {
       const params = new URLSearchParams();
       for (const [key, value] of Object.entries(query)) {
@@ -27658,7 +27681,7 @@ var ParallClient = class _ParallClient {
     void _drop;
     let res;
     try {
-      res = await fetch(`${this.baseUrl}${path15}`, {
+      res = await fetch(`${this.baseUrlFor(path15)}${path15}`, {
         method,
         headers,
         body,
@@ -27818,6 +27841,21 @@ var ParallClient = class _ParallClient {
       q.limit = String(params.limit);
     return this.request("GET", ENDPOINTS.ORG_MEMBER_TASKS(orgId, memberId), void 0, q);
   }
+  // Auto-paginated variant of getMemberTasks: fetches ALL pending tasks
+  // (todo + in_progress) assigned to a member, including subtasks (the
+  // endpoint does not filter parent_id). Powers the CLI `tasks assigned`
+  // command so an agent answering "what's on X's plate" sees the full
+  // backlog, not just the first page.
+  async getMemberTasksAll(orgId, memberId) {
+    const all = [];
+    let cursor;
+    do {
+      const res = await this.getMemberTasks(orgId, memberId, { cursor, limit: 100 });
+      all.push(...res.data);
+      cursor = res.has_more ? res.next_cursor : void 0;
+    } while (cursor);
+    return all;
+  }
   // ---- Invitations ----
   async createInvitation(orgId, email, role) {
     return this.request("POST", ENDPOINTS.ORG_INVITATIONS(orgId), { email, role });
@@ -28247,7 +28285,8 @@ var ParallClient = class _ParallClient {
     const res = await this.request("GET", ENDPOINTS.MACHINES_ME_CLIPS);
     return res.data;
   }
-  /** `GET /machines/me/browser-profiles` — browser profiles hosted by this machine. */
+  /** `GET /machines/me/browser-profiles` — browser profiles hosted by this machine.
+   *  Returns the daemon DTO (carries proxy_password for bb-browser replay). */
   async listMachineBrowserProfiles() {
     const res = await this.request("GET", ENDPOINTS.MACHINES_ME_BROWSER_PROFILES);
     return res.data;
@@ -28407,7 +28446,7 @@ var ParallClient = class _ParallClient {
    * Returns null when the server responds with 304 (config unchanged).
    */
   async getPlatformConfig(currentVersion) {
-    const url = `${this.baseUrl}${ENDPOINTS.PLATFORM_CONFIG}`;
+    const url = `${this.baseUrlFor(ENDPOINTS.PLATFORM_CONFIG)}${ENDPOINTS.PLATFORM_CONFIG}`;
     const extra = {};
     if (currentVersion !== void 0) {
       extra["If-None-Match"] = currentVersion;
@@ -28573,6 +28612,55 @@ var ParallClient = class _ParallClient {
   async getScheduleRun(orgId, runId) {
     return this.request("GET", ENDPOINTS.SCHEDULE_RUN(orgId, runId));
   }
+  // ---- External triggers (org-scoped) ----
+  async createExternalConnection(orgId, input) {
+    return this.request("POST", ENDPOINTS.EXTERNAL_CONNECTIONS(orgId), input);
+  }
+  async listExternalConnections(orgId, filters) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_CONNECTIONS(orgId), void 0, filters);
+  }
+  async getExternalConnection(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_CONNECTION(orgId, connectionId));
+  }
+  async updateExternalConnection(orgId, connectionId, patch) {
+    return this.request("PATCH", ENDPOINTS.EXTERNAL_CONNECTION(orgId, connectionId), patch);
+  }
+  async regenerateExternalConnectionIngressToken(orgId, connectionId) {
+    return this.request("POST", ENDPOINTS.EXTERNAL_CONNECTION_INGRESS_TOKEN_REGENERATE(orgId, connectionId));
+  }
+  async deleteExternalConnection(orgId, connectionId) {
+    return this.request("DELETE", ENDPOINTS.EXTERNAL_CONNECTION(orgId, connectionId));
+  }
+  async getExternalTriggerSchema(orgId, connectionId) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER_SCHEMA(orgId, connectionId));
+  }
+  async listExternalIngressEvents(orgId, filters) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_INGRESS_EVENTS(orgId), void 0, filters);
+  }
+  async getExternalIngressEvent(orgId, eventId) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_INGRESS_EVENT(orgId, eventId));
+  }
+  async createExternalTrigger(orgId, input) {
+    return this.request("POST", ENDPOINTS.EXTERNAL_TRIGGERS(orgId), input);
+  }
+  async listExternalTriggers(orgId, filters) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGERS(orgId), void 0, filters);
+  }
+  async getExternalTrigger(orgId, triggerId) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER(orgId, triggerId));
+  }
+  async updateExternalTrigger(orgId, triggerId, patch) {
+    return this.request("PATCH", ENDPOINTS.EXTERNAL_TRIGGER(orgId, triggerId), patch);
+  }
+  async deleteExternalTrigger(orgId, triggerId) {
+    return this.request("DELETE", ENDPOINTS.EXTERNAL_TRIGGER(orgId, triggerId));
+  }
+  async listExternalTriggerRuns(orgId, filters) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER_RUNS(orgId), void 0, filters);
+  }
+  async getExternalTriggerRun(orgId, runId) {
+    return this.request("GET", ENDPOINTS.EXTERNAL_TRIGGER_RUN(orgId, runId));
+  }
   // ---- Wikis (org-scoped) ----
   async createWiki(orgId, data) {
     return this.request("POST", ENDPOINTS.WIKIS(orgId), data);
@@ -28587,8 +28675,35 @@ var ParallClient = class _ParallClient {
   async getWikiTree(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_TREE(orgId, wikiId), void 0, params);
   }
+  /**
+   * Resolve a server-returned, host-relative media URL (a wiki `signed_url`
+   * like `/wiki/v1/signed/files?token=...`) against this client's base origin,
+   * so it can be dropped straight into a browser `<img>`/`<video>`/`<iframe>`
+   * `src`.
+   *
+   * wiki-service returns these relative on purpose — it doesn't know its own
+   * public origin. A relative `src` resolves against the *page* origin, which
+   * only works when the page and wiki-service share an origin (local dev:
+   * same-origin + Next.js `/wiki/*` proxy). In deployed envs the app
+   * (app.parall.com) and wiki-service (api.parall.com) are different origins,
+   * so `app.parall.com/wiki/v1/signed/files` hits the SPA's own `/wiki/[...]`
+   * catch-all route — an `<iframe>` then recursively renders the whole app
+   * instead of the file. Prefixing with the wiki base (the exact origin every
+   * wiki API request already uses — `baseUrlFor` resolves `/wiki/v1` paths to
+   * `wikiBaseUrl`) makes the URL absolute against the origin that actually
+   * serves the bytes. An empty base (local dev, same-origin proxy) leaves it
+   * relative, preserving the proxy path.
+   */
+  absoluteMediaUrl(url) {
+    if (/^https?:\/\//i.test(url))
+      return url;
+    return `${this.baseUrlFor(url)}${url}`;
+  }
   async getWikiBlob(orgId, wikiId, params) {
-    return this.request("GET", ENDPOINTS.WIKI_BLOB(orgId, wikiId), void 0, params);
+    const blob = await this.request("GET", ENDPOINTS.WIKI_BLOB(orgId, wikiId), void 0, params);
+    if (blob.signed_url)
+      blob.signed_url = this.absoluteMediaUrl(blob.signed_url);
+    return blob;
   }
   async getWikiNodeSections(orgId, wikiId, params) {
     return this.request("GET", ENDPOINTS.WIKI_NODE_SECTIONS(orgId, wikiId), void 0, params);
@@ -28678,7 +28793,10 @@ var ParallClient = class _ParallClient {
    * token — don't leak it.
    */
   async getWikiFilePreviewUrl(orgId, wikiId, params) {
-    return this.request("POST", ENDPOINTS.WIKI_FILE_PREVIEW_URL(orgId, wikiId), params);
+    const res = await this.request("POST", ENDPOINTS.WIKI_FILE_PREVIEW_URL(orgId, wikiId), params);
+    if (res.url)
+      res.url = this.absoluteMediaUrl(res.url);
+    return res;
   }
   // ---- Wiki Path Scopes (AFCS ACL) ----
   async getWikiPathScopes(orgId, wikiId) {
@@ -28755,6 +28873,16 @@ var ParallClient = class _ParallClient {
   async getBacklinks(orgId, params) {
     return this.request("GET", ENDPOINTS.REFS_BACKLINKS(orgId), void 0, params);
   }
+  /**
+   * Bounded multi-hop walk of the prll:// reference graph around `uri`. `uri`
+   * must be an entity-level prll:// URI — a refined URI (path/query/fragment) is
+   * rejected with 400 UNSUPPORTED_REFINED_URI. `depth` is clamped server-side to
+   * [1, 4]; breadth (node/edge counts) is capped server-side and surfaced via
+   * `truncated`. ACL is applied per hop (chat membership + wiki path scope).
+   */
+  async getRefsGraph(orgId, params) {
+    return this.request("GET", ENDPOINTS.REFS_GRAPH(orgId), void 0, params);
+  }
   async checkBrokenRefs(orgId) {
     return this.request("GET", ENDPOINTS.REFS_CHECK(orgId));
   }
@@ -28894,6 +29022,9 @@ var ParallClient = class _ParallClient {
     const resp = await this.request("GET", ENDPOINTS.CLIP_ONLINE(orgId));
     return resp.data;
   }
+  /** Org-wide browser-profile discovery list. Returns the sanitized
+   *  {@link BrowserProfileListItem} shape (not the full domain model), each row
+   *  carrying a per-viewer `can_open` control hint. */
   async listBrowserProfiles(orgId) {
     const resp = await this.request("GET", ENDPOINTS.BROWSER_PROFILES(orgId));
     return resp.data;
@@ -31692,6 +31823,10 @@ function encodeEnvelope2(msg) {
   header.writeUInt32BE(json.length, 1);
   return Buffer.concat([header, json]);
 }
+function registrationKey(clips) {
+  const sorted = [...clips].sort((a, b) => (a.alias ?? "").localeCompare(b.alias ?? ""));
+  return JSON.stringify(sorted);
+}
 var EnvelopeDecoder2 = class _EnvelopeDecoder {
   buf = Buffer.alloc(0);
   push(chunk) {
@@ -31727,7 +31862,15 @@ var ClipProvider = class _ClipProvider {
   heartbeatTimer = null;
   statusUnsubscribe = null;
   manifestUnsubscribe = null;
+  // Set when the clip manifest/set changed and the hub's copy is stale. Drained
+  // by flushReregister(), which re-registers IN-STREAM (no reconnect).
   needsReregister = false;
+  // Canonical key of the clip-registration set last sent to the hub on the
+  // CURRENT stream. flushReregister diff-gates against it so a cold-start that
+  // re-derives an identical set (the common case — a clip's command surface is
+  // stable across spawns) does not emit a redundant re-register. Reset per
+  // stream; the first-frame register in openStream re-seeds it.
+  lastRegisteredKey = null;
   // Monotonic stream id, bumped by openStream(). Handlers from a stream that a
   // newer openStream() has superseded bail in handleDisconnect(gen), so their
   // late close/end/error can't reconnect against the healthy replacement.
@@ -31768,6 +31911,7 @@ var ClipProvider = class _ClipProvider {
     if (this.stopped)
       return;
     const gen = ++this.streamGeneration;
+    this.lastRegisteredKey = null;
     try {
       this.closeStream();
       this.closeSession();
@@ -31866,21 +32010,57 @@ var ClipProvider = class _ClipProvider {
   startHeartbeat() {
     this.clearHeartbeatTimer();
     this.heartbeatTimer = setInterval(() => {
-      if (this.needsReregister) {
-        this.needsReregister = false;
-        this.opts.log.info("[clip-provider] manifest updated \u2014 reconnecting to re-register clips");
-        this.connected = false;
-        this.clearHeartbeatTimer();
-        this.clearReconnectTimer();
-        void this.openStream();
-        return;
-      }
+      this.flushReregister();
       this.sendProviderMessage({ ping: { sentAtUnixMs: Date.now() } }).catch((err) => {
         this.opts.log.warn(`[clip-provider] heartbeat send failed: ${String(err)}`);
       });
     }, _ClipProvider.HEARTBEAT_INTERVAL_MS);
     this.heartbeatTimer.unref?.();
   }
+  /**
+   * Re-register the current clip set on the OPEN stream — the daemon's response
+   * to a manifest/clip-set change. The hub overwrites its stored set from this
+   * full register (clip-provider-sharing-design §11), so a clip install / wake /
+   * sleep no longer requires tearing down and reopening the ProviderStream,
+   * which used to drop any invoke in flight on that stream (in-flight requests
+   * are keyed by request_id on the hub and survive a clip-set swap).
+   *
+   * No-op when the stream is not currently writable; needsReregister stays set
+   * so the next heartbeat tick (or the post-connect flush) retries.
+   *
+   * Against an older hub that still rejects an in-stream duplicate register, the
+   * write reaches a stream the hub then resets; the resulting stream error runs
+   * the normal reconnect path, which re-registers as the first frame — i.e. it
+   * degrades to the previous reconnect-to-re-register behavior, so no capability
+   * negotiation is needed (deploy the hub first).
+   */
+  flushReregister() {
+    if (!this.needsReregister)
+      return;
+    if (!this.connected || !this.stream || this.stream.closed || this.stream.destroyed)
+      return;
+    const clips = this.buildClipRegistrations();
+    if (registrationKey(clips) === this.lastRegisteredKey) {
+      this.needsReregister = false;
+      return;
+    }
+    this.needsReregister = false;
+    this.opts.log.info("[clip-provider] re-registering clips in-stream");
+    this.sendRegister(clips).catch((err) => {
+      this.opts.log.warn(`[clip-provider] in-stream re-register failed: ${String(err)}`);
+      this.needsReregister = true;
+    });
+  }
+  /**
+   * Re-register the current clip set on the open stream — public entry for the
+   * supervisor when machine clip assignments change. Same in-stream path as a
+   * manifest update (no reconnect, in-flight invokes survive). Safe when
+   * disconnected: the flag is flushed on the next heartbeat / post-connect.
+   */
+  reregister() {
+    this.needsReregister = true;
+    this.flushReregister();
+  }
   closeStream() {
     if (this.stream) {
       try {
@@ -31915,7 +32095,7 @@ var ClipProvider = class _ClipProvider {
       });
     });
     this.manifestUnsubscribe = mgr.addManifestListener(() => {
-      this.needsReregister = true;
+      this.reregister();
     });
   }
   unsubscribeStatusChanges() {
@@ -31932,6 +32112,8 @@ var ClipProvider = class _ClipProvider {
       this.handleRegistered(msg.registerResponse);
     } else if (msg.invokeCommand) {
       void this.handleInvokeCommand(msg.invokeCommand);
+    } else if (msg.viewerCommand) {
+      void this.handleViewerCommand(msg.viewerCommand);
     } else if (msg.pong !== void 0) {
     }
   }
@@ -31941,6 +32123,7 @@ var ClipProvider = class _ClipProvider {
       this.connected = true;
       this.reconnectAttempt = 0;
       this.startHeartbeat();
+      this.flushReregister();
     } else {
       this.opts.log.error(`[clip-provider] registration rejected: ${reg.message}`);
       this.stopped = true;
@@ -31994,17 +32177,64 @@ var ClipProvider = class _ClipProvider {
       });
     }
   }
+  /**
+   * Handle a hosted-browser live-viewer command relayed by clip-service over the
+   * stream and reply on the same stream (design §3.4). Always answers the
+   * request/reply bridge exactly once — `{result}` on success, `{error:{message}}`
+   * on failure — and never throws into the message loop, mirroring the BYOC
+   * daemon's handleBrowserProfileViewer (which replies over HTTP instead).
+   */
+  async handleViewerCommand(cmd) {
+    const { requestId } = cmd;
+    if (!this.opts.onViewerCommand) {
+      await this.sendViewerReply(requestId, {
+        error: { message: "live viewer is not supported by this provider" }
+      }).catch(() => {
+      });
+      return;
+    }
+    try {
+      let input;
+      if (cmd.input) {
+        const decoded = Buffer.from(cmd.input, "base64").toString("utf-8");
+        try {
+          input = JSON.parse(decoded);
+        } catch {
+          input = void 0;
+        }
+      }
+      const result = await this.opts.onViewerCommand({
+        profileId: cmd.profileId,
+        sessionId: cmd.sessionId,
+        command: cmd.command,
+        input,
+        turn: cmd.turn
+      });
+      await this.sendViewerReply(requestId, { result });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.opts.log.warn(`[clip-provider] viewer command failed (profile=${cmd.profileId}, command=${cmd.command}): ${message}`);
+      await this.sendViewerReply(requestId, { error: { message } }).catch(() => {
+      });
+    }
+  }
+  /** Send a hosted-viewer reply (base64-encoded JSON body) on the stream. */
+  async sendViewerReply(requestId, reply) {
+    const payload = Buffer.from(JSON.stringify(reply), "utf-8").toString("base64");
+    await this.sendProviderMessage({ viewerResult: { requestId, payload } });
+  }
   // ---------------------------------------------------------------------------
   // Sending
   // ---------------------------------------------------------------------------
-  async sendRegister() {
-    const clips = this.buildClipRegistrations();
+  async sendRegister(prebuilt) {
+    const clips = prebuilt ?? this.buildClipRegistrations();
     await this.sendProviderMessage({
       register: {
         providerName: this.opts.providerName,
         clips
       }
     });
+    this.lastRegisteredKey = registrationKey(clips);
   }
   async sendProviderMessage(msg) {
     if (!this.stream || this.stream.closed || this.stream.destroyed) {
@@ -32113,12 +32343,27 @@ var BB_VIEWER_HEALTH_TIMEOUT_MS = 1e4;
 var BB_VIEWER_COMMAND_TIMEOUT_MS = 15e3;
 var BB_VIEWER_UNANSWERED_REAP_MS = 9e4;
 var BB_VIEWER_TERM_GRACE_MS = 5e3;
+function isLoopbackBindHost(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function kickHitsCurrentSession(requested, currentSessionId) {
+  if (currentSessionId === void 0)
+    return false;
+  return requested === void 0 || requested === currentSessionId;
+}
 var BrowserViewerStreamer = class {
   host;
   // Live bb-viewer (WebRTC streamer) subprocess per profile. One per profile;
   // see StreamerState. Cleaned up on stream.close, stopProfile, resetProfile,
   // and stop().
   streamers = /* @__PURE__ */ new Map();
+  // The most-recently server-side-kicked viewer session per profile (design §3.6
+  // PR7). After a kick the streamer is gone, so the session-staleness guards
+  // (which key off a live streamer) can no longer reject the kicked viewer's
+  // straggler nav commands — this map does. Reset whenever the profile's streamer
+  // is (re)killed via killProfileStreamer, so a fresh stream.start clears it. One
+  // entry per profile (overwritten per kick); bounded, no leak.
+  kickedSessions = /* @__PURE__ */ new Map();
   // Set by shutdown(): an in-flight spawnStreamer has no map entry yet, so a
   // shutdown during its health poll would otherwise let the bb-viewer child
   // survive daemon stop (on BYOC nothing else reaps it).
@@ -32135,6 +32380,9 @@ var BrowserViewerStreamer = class {
   async handleViewerCommand(profileId, sessionId, command, input, turn) {
     if (!profileId)
       throw new Error("browser profile id is required");
+    if (command !== "stream.start" && sessionId && this.kickedSessions.get(profileId) === sessionId) {
+      throw new Error("viewer session was terminated");
+    }
     switch (command) {
       case "stream.start":
         return this.viewerStreamStart(profileId, sessionId, turn);
@@ -32144,6 +32392,8 @@ var BrowserViewerStreamer = class {
         return this.viewerStreamClose(profileId, sessionId, input);
       case "stream.switch":
         return this.viewerStreamSwitch(profileId, sessionId, input);
+      case "kick":
+        return this.viewerKick(profileId, sessionId, input);
       case "close":
         return this.viewerCloseTab(profileId, sessionId, input);
       case "tab_list":
@@ -32157,6 +32407,31 @@ var BrowserViewerStreamer = class {
         throw new Error(`unknown viewer command: ${command}`);
     }
   }
+  /**
+   * kick — server-side per-viewer disconnect (design §3.6 PR7). Terminates ONE
+   * viewer's WebRTC session: stop its bb-viewer streamer (killing the process
+   * tears down the peer connection + datachannel) and reject the kicked session's
+   * subsequent commands — while bb-browser + Chromium (the agent's live browser)
+   * keep running. This is explicitly DISTINCT from stopping the pod / profile,
+   * which would kill the agent's browser too; a viewer session is a sub-session of
+   * the profile lease, so a kick does NOT release the lease.
+   *
+   * Targets `input.session_id` if given, else the current streamer's session.
+   * Idempotent: kicking with no live streamer still records the kicked session.
+   */
+  viewerKick(profileId, sessionId, input) {
+    const streamer = this.streamers.get(profileId);
+    const requested = typeof input?.session_id === "string" ? input.session_id : void 0;
+    const target = requested || streamer?.sessionId || sessionId;
+    const killsCurrent = kickHitsCurrentSession(requested, streamer?.sessionId);
+    if (killsCurrent) {
+      this.killProfileStreamer(profileId);
+    }
+    if (target)
+      this.kickedSessions.set(profileId, target);
+    this.host.log.info(`[bb-viewer] kicked viewer session ${target || "(none)"} for profile ${profileId}; pod + agent browser keep running`);
+    return target ? { ok: true, kicked: true, session_id: target } : { ok: true, kicked: true };
+  }
   /**
    * stream.start — spawn a FRESH bb-viewer for this profile (killing any prior
    * one), resolve the profile's account-scoped page-target CDP ws URL, and run
@@ -32453,6 +32728,13 @@ var BrowserViewerStreamer = class {
     const bin = process.env.PRLL_BB_VIEWER_BIN ?? "bb-viewer";
     const port = await findFreePort();
     const args = ["--api-only", "--port", String(port)];
+    const bindHost = process.env.PRLL_BB_VIEWER_HOST?.trim();
+    if (bindHost) {
+      if (!isLoopbackBindHost(bindHost)) {
+        throw new Error(`PRLL_BB_VIEWER_HOST must be loopback (127.0.0.1, localhost, ::1, [::1]) \u2014 refusing to bind bb-viewer's unauthenticated /command to ${bindHost}`);
+      }
+      args.push("--host", bindHost);
+    }
     if (turn?.url) {
       args.push("--turn-url", turn.url, "--turn-user", turn.username ?? "", "--turn-cred", turn.credential ?? "");
     }
@@ -32570,8 +32852,14 @@ var BrowserViewerStreamer = class {
       clearTimeout(timer);
     }
   }
-  /** Kill + remove the profile's bb-viewer streamer, if any. Idempotent. */
+  /**
+   * Kill + remove the profile's bb-viewer streamer, if any. Idempotent. Also
+   * clears any kick marker for the profile: a (re)kill establishes a clean
+   * streamer slot, so a subsequent stream.start starts un-kicked. viewerKick
+   * re-records the kicked session AFTER calling this.
+   */
   killProfileStreamer(profileId) {
+    this.kickedSessions.delete(profileId);
     const streamer = this.streamers.get(profileId);
     if (!streamer)
       return;
@@ -32908,10 +33196,12 @@ var BrowserProfileManager = class {
         if (!isBrowserAccountInfoUnauthenticatedError(err)) {
           if (!isBrowserAccountNotFoundError(err))
             throw err;
+          const proxy = this.opts.resolveProxy ? await this.opts.resolveProxy(account) : null;
           await this.sendCommand({
             method: "account_create",
             account,
-            ...accountUrl ? { accountUrl } : {}
+            ...accountUrl ? { accountUrl } : {},
+            ...proxyCreateFields(proxy)
           });
           accountCreated = true;
         }
@@ -33168,6 +33458,16 @@ function resolveBbBrowserDaemonPath() {
 function randomToken() {
   return randomBytes(16).toString("hex");
 }
+function proxyCreateFields(proxy) {
+  if (!proxy?.server)
+    return {};
+  const fields = { proxyServer: proxy.server };
+  if (proxy.username)
+    fields.proxyUsername = proxy.username;
+  if (proxy.password)
+    fields.proxyPassword = proxy.password;
+  return fields;
+}
 
 // ts/daemon/dist/supervisor.js
 init_config();
@@ -34095,7 +34395,8 @@ var DaemonSupervisor = class {
         log: this.log,
         reportStatus: (profileId, status, errorMsg) => {
           this.client.reportBrowserProfileStatus(profileId, status, errorMsg).catch((err) => this.log.warn(`browser profile status report failed: ${String(err)}`));
-        }
+        },
+        resolveProxy: (profileId) => this.resolveBrowserProfileProxy(profileId)
       });
       this.clipManager = new ClipProcessManager({
         clipsDir: path13.join(this.config.rootStateDir, "clips"),
@@ -34343,10 +34644,13 @@ var DaemonSupervisor = class {
     for (const profile of profiles) {
       if (profile.status !== "running" && profile.status !== "pending")
         continue;
+      if (!profile.machine_id)
+        continue;
+      const machineId = profile.machine_id;
       try {
         if (profile.status === "pending") {
           await this.enqueueBrowserProfileLifecycle({
-            machine_id: profile.machine_id,
+            machine_id: machineId,
             profile_id: profile.id,
             action: "open"
           });
@@ -34358,6 +34662,30 @@ var DaemonSupervisor = class {
       }
     }
   }
+  /**
+   * Resolve a profile's outbound proxy for bb-browser account creation (BYOC).
+   * Fetched fresh — account creation is rare (once per profile until reset), so a
+   * proxy edit applies on the next account_create. The mck_-authed machine list is
+   * the only path that carries proxy_password (for replay to bb-browser).
+   *
+   * Fails closed: a fetch failure or a vanished profile THROWS, so the manager never
+   * creates an account that would egress from the host's real IP for a
+   * proxy-configured profile (the caller reports `error` and retries next tick).
+   */
+  async resolveBrowserProfileProxy(profileId) {
+    const profiles = await this.client.listMachineBrowserProfiles();
+    const profile = profiles.find((p) => p.id === profileId);
+    if (!profile) {
+      throw new Error(`browser profile ${profileId} not found; refusing to create a bb-browser account without its proxy config`);
+    }
+    if (!profile.proxy_server)
+      return null;
+    return {
+      server: profile.proxy_server,
+      username: profile.proxy_username ?? void 0,
+      password: profile.proxy_password ?? void 0
+    };
+  }
   // ---- Flat layout migration (self-hosted → daemon) ----
   /**
    * Detects a legacy flat state layout (no agents/ subdir) and migrates it
@@ -34602,7 +34930,7 @@ var DaemonSupervisor = class {
     }
     if (changed) {
       this.log.info(`machine clips synced \u2014 count=${desired.length}`);
-      await this.reconnectClipProvider();
+      this.clipProvider?.reregister();
     }
   }
   startClipReconcileTimer() {
@@ -34731,15 +35059,6 @@ var DaemonSupervisor = class {
     }
     return null;
   }
-  async reconnectClipProvider() {
-    if (!this.clipProvider)
-      return;
-    const provider = this.clipProvider;
-    this.clipProvider = null;
-    this.connectedClipServiceUrl = null;
-    await provider.disconnect().catch((err) => this.log.warn(`clip provider reconnect disconnect failed: ${String(err)}`));
-    await this.applyClipProviderState();
-  }
   async handleWorkspaceSetupRequested(agentId) {
     if (this.spawningAgents.has(agentId)) {
       this.log.info(`agent ${agentId}: workspace setup already in progress; queueing one restart`);